Generic ISO15693 Ops

# ISO 15693

Some usage examples:

Send an INQUIRY Command to tags in range:

proxmark3> hf 15 cmd inquiry UID=E00700001A0xxxxxx Tag Info: Texas Instrument; Tag-it HF-I Plus Inlay; 64x32bit

Read page 2 from a specific tag:

proxmark3> hf 15 cmd read E0054000076xxxxx 2 Using UID E0054000076xxxxx 2E 80 53 42 ..SB

Read page 2 from a tag in range (automatically find tag via INQUIRY first)

proxmark3> hf 15 cmd read * 2 Using UID E0054000076xxxxx 2E 80 53 42 ..SB

Read page 2 from any tag in range - using unaddressed commands (not supported by all tags)

proxmark3> hf 15 cmd read u 2 2E 80 53 42 ..SB

Write data to page 20 on a tag:

proxmark3> hf 15 cmd read u 20 00 00 00 00

proxmark3> hf 15 cmd write -o u 20 1234ABCD no answer

proxmark3> hf 15 cmd read u 20 12 34 AB CD

Note: the OPTION-Flag (-o) is mandatory on all TI Hi-Tags HF-I. Note: As writing takes longer then usual operations, we run into a timeout - but the data is still written.

Send raw data to a tag:

proxmark3>** hf 15 cmd raw -2 -c 26 01 00** received 12 octets

where -2 turnes of 1of256 longrange/lowspeed mode and -c calculates the correct CRC and adds it. To view the received data, you have to turn of debug mode, which will also give you other info as well:

proxmark3>** hf 15 cmd debug 1** #db# Iso15693 Debug is now on

Read all the memory from a tag (shown as HEX and ASCII):

proxmark3>** hf 15 dumpmemory** Reading memory from tag UID=E00700001A0xxxxx Tag Info: Texas Instrument; Tag-it HF-I Plus Inlay; 64x32bit Block 0 00 00 FC 2A ...* Block 1 00 00 00 00 .... Block 2 0B B8 67 94 ..g. Block 3 57 A8 2D A6 W.-. ...

Find the AFI of an Tag:

proxmark3>** hf 15 findafi** #db# NoAFI UID=E00700001A0xxxxx #db# AFI=0 UID=E00700001A0xxxxx #db# AFI=20 UID=E00700001A0xxxxx #db# AFI Bruteforcing done.

Note: a "SetAFI" command will be added soon.

multi page read command

proxmark3> hf 15 cmd readmulti u 2 3 00 00 00 00 BA 14 1B DB 06 60 19 00 ........`..

Tag-"system information" command:

proxmark3> hf 15 cmd sysinfo u 0E xx xx 18 0E 02 94 16 E0 00 32 08 94 UID = E01694020E18xxxx EM-Marin SA (Skidata) DSFID not supported AFI supported, set to 000 Tag provides info on memory layout (vendor dependent) 9 (or 8) bytes/page x 51 pages IC reference given: 94

Some vendors haven’t read the specification carefully enough, so there are off-by-one errors possible in the memory layout information. (EM-Marin is doing it wrong, TI values the ISO standard)