proxmark3/include/iso18.h

//-----------------------------------------------------------------------------
// Copyright (C) Proxmark3 contributors. See AUTHORS.md for details.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.
//
// See LICENSE.txt for the text of the license.
//-----------------------------------------------------------------------------
// ISO 18002 / FeliCa type prototyping
//-----------------------------------------------------------------------------
#ifndef _ISO18_H_
#define _ISO18_H_

#include "common.h"

// FeliCa length byte includes itself, so application-level payload max is 254 bytes.
#define FELICA_MAX_DATA_SIZE 254U
// 255 base length (max 254 data + 1 len byte) + 2 sync + 2 crc + 1 extra for safety.
#define FELICA_MAX_RF_FRAME_SIZE 260U
#define FELICA_SPECIFICATION_VERSION_MAX_OPTIONS 16U
#define FELICA_SYSTEM_NODE 0xFFFFU

#define FELICA_SERVICE_ATTRIBUTE_UNAUTH_READ    0x01U
#define FELICA_SERVICE_ATTRIBUTE_READ_ONLY      0x02U
#define FELICA_SERVICE_ATTRIBUTE_RANDOM_ACCESS  0x08U
#define FELICA_SERVICE_ATTRIBUTE_CYCLIC         0x0CU
#define FELICA_SERVICE_ATTRIBUTE_PURSE          0x10U
#define FELICA_SERVICE_ATTRIBUTE_PIN_REQUIRED   0x20U
#define FELICA_SERVICE_ATTRIBUTE_PURSE_SUBFIELD 0x06U
#define FELICA_NODE_ATTRIBUTE_MASK              0x3FU

#define FELICA_AREA_ATTRIBUTE_CAN_CREATE_SUBAREA             0x00U
#define FELICA_AREA_ATTRIBUTE_CANNOT_CREATE_SUBAREA          0x01U
#define FELICA_AREA_ATTRIBUTE_CAN_CREATE_SUBAREA_WITH_PIN    0x20U
#define FELICA_AREA_ATTRIBUTE_CANNOT_CREATE_SUBAREA_WITH_PIN 0x21U
#define FELICA_AREA_ATTRIBUTE_END_ROOT_AREA                  0x3EU
#define FELICA_AREA_ATTRIBUTE_END_SUB_AREA                   0x3FU

#define FELICA_SERVICE_ATTRIBUTE_RANDOM_RW_WITH_KEY            0x08U
#define FELICA_SERVICE_ATTRIBUTE_RANDOM_RW_WITHOUT_KEY         0x09U
#define FELICA_SERVICE_ATTRIBUTE_RANDOM_RO_WITH_KEY            0x0AU
#define FELICA_SERVICE_ATTRIBUTE_RANDOM_RO_WITHOUT_KEY         0x0BU
#define FELICA_SERVICE_ATTRIBUTE_CYCLIC_RW_WITH_KEY            0x0CU
#define FELICA_SERVICE_ATTRIBUTE_CYCLIC_RW_WITHOUT_KEY         0x0DU
#define FELICA_SERVICE_ATTRIBUTE_CYCLIC_RO_WITH_KEY            0x0EU
#define FELICA_SERVICE_ATTRIBUTE_CYCLIC_RO_WITHOUT_KEY         0x0FU
#define FELICA_SERVICE_ATTRIBUTE_PURSE_RW_WITH_KEY             0x10U
#define FELICA_SERVICE_ATTRIBUTE_PURSE_RW_WITHOUT_KEY          0x11U
#define FELICA_SERVICE_ATTRIBUTE_PURSE_CASHBACK_WITH_KEY       0x12U
#define FELICA_SERVICE_ATTRIBUTE_PURSE_CASHBACK_WITHOUT_KEY    0x13U
#define FELICA_SERVICE_ATTRIBUTE_PURSE_DECREMENT_WITH_KEY      0x14U
#define FELICA_SERVICE_ATTRIBUTE_PURSE_DECREMENT_WITHOUT_KEY   0x15U
#define FELICA_SERVICE_ATTRIBUTE_PURSE_RO_WITH_KEY             0x16U
#define FELICA_SERVICE_ATTRIBUTE_PURSE_RO_WITHOUT_KEY          0x17U

#define FELICA_SERVICE_ATTRIBUTE_RANDOM_RW_WITH_KEY_WITH_PIN          0x28U
#define FELICA_SERVICE_ATTRIBUTE_RANDOM_RW_WITHOUT_KEY_WITH_PIN       0x29U
#define FELICA_SERVICE_ATTRIBUTE_RANDOM_RO_WITH_KEY_WITH_PIN          0x2AU
#define FELICA_SERVICE_ATTRIBUTE_RANDOM_RO_WITHOUT_KEY_WITH_PIN       0x2BU
#define FELICA_SERVICE_ATTRIBUTE_CYCLIC_RW_WITH_KEY_WITH_PIN          0x2CU
#define FELICA_SERVICE_ATTRIBUTE_CYCLIC_RW_WITHOUT_KEY_WITH_PIN       0x2DU
#define FELICA_SERVICE_ATTRIBUTE_CYCLIC_RO_WITH_KEY_WITH_PIN          0x2EU
#define FELICA_SERVICE_ATTRIBUTE_CYCLIC_RO_WITHOUT_KEY_WITH_PIN       0x2FU
#define FELICA_SERVICE_ATTRIBUTE_PURSE_RW_WITH_KEY_WITH_PIN           0x30U
#define FELICA_SERVICE_ATTRIBUTE_PURSE_RW_WITHOUT_KEY_WITH_PIN        0x31U
#define FELICA_SERVICE_ATTRIBUTE_PURSE_CASHBACK_WITH_KEY_WITH_PIN     0x32U
#define FELICA_SERVICE_ATTRIBUTE_PURSE_CASHBACK_WITHOUT_KEY_WITH_PIN  0x33U
#define FELICA_SERVICE_ATTRIBUTE_PURSE_DECREMENT_WITH_KEY_WITH_PIN    0x34U
#define FELICA_SERVICE_ATTRIBUTE_PURSE_DECREMENT_WITHOUT_KEY_WITH_PIN 0x35U
#define FELICA_SERVICE_ATTRIBUTE_PURSE_RO_WITH_KEY_WITH_PIN           0x36U
#define FELICA_SERVICE_ATTRIBUTE_PURSE_RO_WITHOUT_KEY_WITH_PIN        0x37U

#define FELICA_ENCRYPTION_IDENTIFIER_AES128        0x4FU
#define FELICA_ENCRYPTION_IDENTIFIER_AES128_DES112 0x43U
#define FELICA_ENCRYPTION_IDENTIFIER_AES128_DES56  0x41U
#define FELICA_ENCRYPTION_IDENTIFIER_DES112        0x3FU
#define FELICA_ENCRYPTION_IDENTIFIER_DES56         0x2FU

typedef enum FELICA_COMMAND {
    FELICA_CONNECT = (1 << 0),
    FELICA_NO_DISCONNECT = (1 << 1),
    // stream the antenna envelope peak-to-peak instead of demodulated bits,
    // so reading distance and coupling can be measured rather than guessed
    FELICA_PROBE = (1 << 2),
    FELICA_RAW = (1 << 3),
    FELICA_APPEND_CRC = (1 << 5),
    FELICA_NO_SELECT = (1 << 6),
    FELICA_CLEARTRACE = (1 << 7),
} felica_command_t;

typedef struct {
    uint8_t flags;      // PM3 flags, see felica_command_t
    uint16_t numbits;   // optional number of bits for raw exchange
    uint16_t rawlen;    // bytes in raw[]
    uint8_t raw[];
} PACKED felica_raw_cmd_t;

#define FELICA_RAW_LEN(x) (sizeof(felica_raw_cmd_t) + (x))

typedef struct {
    uint8_t completed;
    uint16_t tracelen;
} PACKED felica_lite_dump_resp_t;

typedef enum FELICA_SIM_SUBCOMMAND {
    FELICA_SIM_CLEAR = 0x00,
    FELICA_SIM_LOAD = 0x01,
    FELICA_SIM_START = 0x02,
} felica_sim_subcommand_t;

typedef enum FELICA_SIM_RWE_ERROR_LOCATION_INDICATION {
    FELICA_SIM_RWE_ERROR_LOCATION_MASK = 0x00,
    FELICA_SIM_RWE_ERROR_LOCATION_INDEX = 0x01,
    FELICA_SIM_RWE_ERROR_LOCATION_FLAG = 0x02,
} felica_sim_rwe_error_location_indication_t;

#define FELICA_SIM_MODEL_MAGIC 0x31465346U // FSF1
#define FELICA_SIM_MODEL_VERSION 3U
#define FELICA_SIM_UPLOAD_CHUNK_MAX (PM3_CMD_DATA_SIZE - sizeof(felica_sim_upload_t))
#define FELICA_SIM_RUNTIME_RESERVE 512U
#define FELICA_SIM_SPECIFICATION_VERSION_MAX_LEN (4U + (FELICA_SPECIFICATION_VERSION_MAX_OPTIONS * 2U))
#define FELICA_SIM_PRODUCT_INFORMATION_MAX_LEN 64U
#define FELICA_SIM_CONTAINER_ISSUE_INFORMATION_LEN 16U

#define FELICA_SIM_NODE_TYPE_MASK    0x03U
#define FELICA_SIM_NODE_TYPE_SERVICE 0x01U
#define FELICA_SIM_NODE_TYPE_AREA    0x02U
#define FELICA_SIM_NODE_TYPE_SYSTEM  0x03U
#define FELICA_SIM_NODE_HAS_DES_KEY_VERSION 0x04U
#define FELICA_SIM_NODE_HAS_AES_KEY_VERSION 0x08U

typedef struct {
    uint8_t subcommand;
    uint32_t total_len;
    uint32_t offset;
    uint16_t model_crc;
    uint16_t chunk_len;
    uint8_t rwe_error_location_indication;
    uint8_t data[];
} PACKED felica_sim_upload_t;

typedef struct {
    uint32_t magic;
    uint16_t version;
    uint16_t header_len;
    uint32_t total_len;
    uint16_t model_crc;
    uint16_t system_count;
    uint16_t node_count;
    uint16_t block_count;
    uint32_t system_offset;
    uint32_t node_offset;
    uint32_t block_offset;
    uint32_t metadata_offset;
    uint16_t specification_version_len;
    uint16_t product_information_len;
    uint16_t container_issue_information_len;
    uint16_t reserved;
} PACKED felica_sim_model_header_t;

typedef struct {
    uint16_t system_code;
    uint8_t idm[8];
    uint8_t pmm[8];
    uint8_t encryption_identifier;
    uint8_t reserved;
    uint16_t first_node;
    uint16_t node_count;
} PACKED felica_sim_system_record_t;

typedef struct {
    uint16_t system_index;
    uint16_t node_code_le;
    uint16_t end_code_le;
    uint16_t first_block;
    uint16_t block_count;
    uint16_t des_key_version_le;
    uint16_t aes_key_version_le;
    uint8_t flags;
    uint8_t reserved;
} PACKED felica_sim_node_record_t;

typedef struct {
    uint16_t node_index;
    uint16_t block_number;
    uint8_t data[16];
} PACKED felica_sim_block_record_t;

//-----------------------------------------------------------------------------
// FeliCa
//-----------------------------------------------------------------------------
// IDm  = ID manufacturer
// mc = manufactureCode
// mc1 mc2 u1 u2 u3 u4 u5 u6
// PMm  = Product manufacturer
// icCode =
//    ic1 = ROM
//    ic2 = IC
// maximum response time =
//    B3(request service)
//    B4(request response)
//    B5(authenticate)
//    B6(read)
//    B7(write)
//    B8()

// ServiceCode  2bytes  (access-rights)
// FileSystem = 1 Block = 16 bytes


typedef struct {
    uint8_t IDm[8];
    uint8_t code[2];
    uint8_t uid[6];
    uint8_t PMm[8];
    uint8_t iccode[2];
    uint8_t mrt[6];
    uint8_t servicecode[2];
} PACKED felica_card_select_t;

typedef struct {
    uint8_t sync[2];
    uint8_t length[1];
    uint8_t cmd_code[1];
    uint8_t IDm[8];
} PACKED felica_frame_response_t;

typedef struct  {
    uint8_t sync[2];
    uint8_t length[1];
    uint8_t cmd_code[1];
} PACKED felica_frame_response_noidm_t;

typedef struct {
    uint8_t status_flag1[1];
    uint8_t status_flag2[1];
} PACKED felica_status_flags_t;

typedef struct {
    uint8_t length[1];
    uint8_t command_code[1];
    uint8_t reserved[2];
} PACKED felica_get_container_id_request_t;

typedef struct {
    felica_frame_response_noidm_t frame_response;
    uint8_t container_idm[8];
} PACKED felica_get_container_id_response_t;

typedef struct {
    uint8_t length[1];
    uint8_t command_code[1];
    uint8_t property_index[2];
} PACKED felica_get_container_property_request_t;

typedef struct {
    felica_frame_response_noidm_t frame_response;
    uint8_t property_data[];
} PACKED felica_get_container_property_response_t;

typedef struct {
    uint8_t length[1];
    uint8_t command_code[1];
    uint8_t IDm[8];
    uint8_t reserved[2];
} PACKED felica_get_container_issue_info_request_t;

typedef struct {
    felica_frame_response_t frame_response;
    uint8_t format_version_carrier_information[5];
    uint8_t mobile_phone_model_information[11];
} PACKED felica_get_container_issue_info_response_t;

typedef struct {
    uint8_t length[1];
    uint8_t command_code[1];
    uint8_t IDm[8];
} PACKED felica_get_platform_info_request_t;

typedef struct {
    uint8_t length[1];
    uint8_t command_code[1];
    uint8_t IDm[8];
    uint8_t reserved[2];
} PACKED felica_request_specification_version_request_t;

typedef struct {
    felica_status_flags_t status_flags;
    bool has_specification_version;
    uint8_t format_version;
    uint8_t basic_version[2];
    uint8_t number_of_option;
    size_t option_version_count;
    uint8_t option_version_list[FELICA_SPECIFICATION_VERSION_MAX_OPTIONS * 2];
} felica_request_specification_version_info_t;

typedef struct {
    felica_frame_response_t frame_response;
    uint8_t node_number[1];
    uint8_t node_key_versions[2];
} PACKED felica_request_service_response_t;

typedef struct {
    felica_frame_response_t frame_response;
    uint8_t mode[1];
} PACKED felica_request_request_response_t;

typedef struct {
    felica_frame_response_t frame_response;
    felica_status_flags_t status_flags;
    uint8_t number_of_block[1];
    uint8_t block_data[16 * 15];
} PACKED felica_read_without_encryption_response_t;

typedef struct {
    felica_frame_response_t frame_response;
    felica_status_flags_t status_flags;
} PACKED felica_status_response_t;

typedef struct {
    uint8_t length[1];
    uint8_t command_code[1];
    uint8_t IDm[8];
} PACKED felica_request_system_code_request_t;

typedef struct {
    felica_frame_response_t frame_response;
    uint8_t number_of_systems[1];
    uint8_t system_code_list[32];
} PACKED felica_syscode_response_t;

typedef struct {
    felica_frame_response_t frame_response;
    uint8_t m2c[8];
    uint8_t m3c[8];
} PACKED felica_auth1_response_t;

typedef struct {
    uint8_t code[1];
    uint8_t IDtc[8];
    uint8_t IDi[8];
    uint8_t PMi[8];
} PACKED felica_auth2_response_t;

typedef struct {
    felica_frame_response_t frame_response;
    uint8_t payload[4];
} PACKED felica_search_service_code_response_t;

typedef struct {
    uint8_t command_code[1];
    uint8_t IDm[8];
    uint8_t number_of_service[1];
    uint8_t service_code_list[2];
    uint8_t number_of_block[1];
} PACKED felica_write_request_haeder_t;

typedef struct {
    uint8_t command_code[1];
    uint8_t IDm[8];
    uint8_t number_of_service[1];
    uint8_t service_code_list[2];
    uint8_t number_of_block[1];
} PACKED felica_read_request_haeder_t;


typedef struct {
    uint8_t random_challenge[16];
    uint8_t session_key[16];
} PACKED felica_auth_context_t;

#endif // _ISO18_H_