]> git.zerfleddert.de Git - proxmark3-svn/blame - client/cmdlfpresco.c
Add ROCA vulnerability test (RRG repository PR 76 by @merlokk) (#762)
[proxmark3-svn] / client / cmdlfpresco.c
CommitLineData
6923d3f1 1//-----------------------------------------------------------------------------
2//
3// This code is licensed to you under the terms of the GNU GPL, version 2 or,
4// at your option, any later version. See the LICENSE.txt file for the text of
5// the license.
6//-----------------------------------------------------------------------------
7// Low frequency Presco tag commands
b9957414 8// ASK/Manchester, rf/32, 128 bits (complete)
6923d3f1 9//-----------------------------------------------------------------------------
ad939de5 10
11#include "cmdlfpresco.h"
12
6923d3f1 13#include <string.h>
14#include <inttypes.h>
acf0582d 15#include <stdio.h>
ad939de5 16#include "comms.h"
29ada8fc 17#include "ui.h"
18#include "util.h"
19#include "graph.h"
20#include "cmdparser.h"
21#include "cmddata.h"
22#include "cmdmain.h"
23#include "cmdlf.h"
24#include "protocols.h" // for T55xx config register definitions
25#include "lfdemod.h" // parityTest
26
6923d3f1 27static int CmdHelp(const char *Cmd);
28
29int usage_lf_presco_clone(void){
30 PrintAndLog("clone a Presco tag to a T55x7 tag.");
29ada8fc 31 PrintAndLog("Usage: lf presco clone d <Card-ID> H <hex-ID> <Q5>");
6923d3f1 32 PrintAndLog("Options :");
29ada8fc 33 PrintAndLog(" d <Card-ID> : 9 digit presco card ID");
34 PrintAndLog(" H <hex-ID> : 8 digit hex card number");
35 PrintAndLog(" <Q5> : specify write to Q5 (t5555 instead of t55x7)");
6923d3f1 36 PrintAndLog("");
29ada8fc 37 PrintAndLog("Sample : lf presco clone d 123456789");
6923d3f1 38 return 0;
39}
40
41int usage_lf_presco_sim(void) {
42 PrintAndLog("Enables simulation of presco card with specified card number.");
43 PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
44 PrintAndLog("Per presco format, the card number is 9 digit number and can contain *# chars. Larger values are truncated.");
45 PrintAndLog("");
29ada8fc 46 PrintAndLog("Usage: lf presco sim d <Card-ID> or H <hex-ID>");
6923d3f1 47 PrintAndLog("Options :");
29ada8fc 48 PrintAndLog(" d <Card-ID> : 9 digit presco card number");
49 PrintAndLog(" H <hex-ID> : 8 digit hex card number");
6923d3f1 50 PrintAndLog("");
29ada8fc 51 PrintAndLog("Sample : lf presco sim d 123456789");
6923d3f1 52 return 0;
53}
54
29ada8fc 55// convert base 12 ID to sitecode & usercode & 8 bit other unknown code
56int GetWiegandFromPresco(const char *Cmd, uint32_t *sitecode, uint32_t *usercode, uint32_t *fullcode, bool *Q5) {
57
6923d3f1 58 uint8_t val = 0;
29ada8fc 59 bool hex = false, errors = false;
60 uint8_t cmdp = 0;
61 char id[11];
62 int stringlen = 0;
63 while(param_getchar(Cmd, cmdp) != 0x00) {
64 switch(param_getchar(Cmd, cmdp)) {
65 case 'h':
66 return -1;
67 case 'H':
68 hex = true;
69 //get hex
70 *fullcode = param_get32ex(Cmd, cmdp+1, 0, 10);
71 cmdp+=2;
72 break;
dab1c6f5 73 case 'D':
74 case 'd':
29ada8fc 75 //param get string int param_getstr(const char *line, int paramnum, char * str)
874572d4 76 stringlen = param_getstr(Cmd, cmdp+1, id, sizeof(id));
29ada8fc 77 if (stringlen < 2) return -1;
78 cmdp+=2;
79 break;
80 case 'Q':
81 case 'q':
82 *Q5 = true;
83 cmdp++;
84 break;
85 default:
86 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
87 errors = 1;
88 break;
89 }
90 if(errors) break;
6923d3f1 91 }
29ada8fc 92 // No args
93 if(cmdp == 0) errors = 1;
6923d3f1 94
29ada8fc 95 //Validations
ebf93643 96 if(errors || (stringlen == 0 && !hex) ) return -1;
6923d3f1 97
29ada8fc 98 if (!hex) {
99 for (int index =0; index < strlen(id); ++index) {
100 // Get value from number string.
101 if ( id[index] == '*' ) val = 10;
102 if ( id[index] == '#') val = 11;
103 if ( id[index] >= 0x30 && id[index] <= 0x39 )
104 val = id[index] - 0x30;
105
106 *fullcode += val;
107
108 // last digit is only added, not multipled.
109 if ( index < strlen(id)-1 )
110 *fullcode *= 12;
111 }
112 }
6923d3f1 113
29ada8fc 114 *usercode = *fullcode & 0x0000FFFF; //% 65566
115 *sitecode = (*fullcode >> 24) & 0x000000FF; // /= 16777216;
116 return 0;
117}
6923d3f1 118
29ada8fc 119// calc not certain - intended to get bitstream for programming / sim
120int GetPrescoBits(uint32_t fullcode, uint8_t *prescoBits) {
121 num_to_bytebits(0x10D00000, 32, prescoBits);
122 num_to_bytebits(0x00000000, 32, prescoBits+32);
123 num_to_bytebits(0x00000000, 32, prescoBits+64);
124 num_to_bytebits(fullcode , 32, prescoBits+96);
6923d3f1 125 return 1;
126}
29ada8fc 127
6923d3f1 128//see ASKDemod for what args are accepted
129int CmdPrescoDemod(const char *Cmd) {
130 if (!ASKDemod(Cmd, false, false, 1)) {
131 if (g_debugMode) PrintAndLog("ASKDemod failed");
132 return 0;
133 }
134 size_t size = DemodBufferLen;
b9957414 135 //call lfdemod.c demod for presco
6923d3f1 136 int ans = PrescoDemod(DemodBuffer, &size);
137 if (ans < 0) {
138 if (g_debugMode) PrintAndLog("Error Presco_Demod %d", ans);
139 return 0;
140 }
141 //got a good demod
142 uint32_t raw1 = bytebits_to_byte(DemodBuffer+ans, 32);
143 uint32_t raw2 = bytebits_to_byte(DemodBuffer+ans+32, 32);
29ada8fc 144 uint32_t raw3 = bytebits_to_byte(DemodBuffer+ans+64, 32);
145 uint32_t raw4 = bytebits_to_byte(DemodBuffer+ans+96, 32);
146 uint32_t cardid = raw4;
6923d3f1 147 PrintAndLog("Presco Tag Found: Card ID %08X", cardid);
29ada8fc 148 PrintAndLog("Raw: %08X%08X%08X%08X", raw1,raw2,raw3,raw4);
9fe4507c 149 setDemodBuf(DemodBuffer, 128, ans);
150 setClockGrid(g_DemodClock, g_DemodStartIdx + (ans*g_DemodClock));
151
29ada8fc 152 uint32_t sitecode = 0, usercode = 0, fullcode = 0;
153 bool Q5=false;
154 char cmd[12] = {0};
155 sprintf(cmd, "H %08X", cardid);
156 GetWiegandFromPresco(cmd, &sitecode, &usercode, &fullcode, &Q5);
157 PrintAndLog("SiteCode %u, UserCode %u, FullCode, %08X", sitecode, usercode, fullcode);
158
6923d3f1 159 return 1;
160}
161
162//see ASKDemod for what args are accepted
163int CmdPrescoRead(const char *Cmd) {
29ada8fc 164 // Presco Number: 123456789 --> Sitecode 30 | usercode 8665
6923d3f1 165
166 // read lf silently
b9957414 167 lf_read(true, 10000);
6923d3f1 168 // demod and output Presco ID
169 return CmdPrescoDemod(Cmd);
170}
171
29ada8fc 172// takes base 12 ID converts to hex
173// Or takes 8 digit hex ID
6923d3f1 174int CmdPrescoClone(const char *Cmd) {
175
29ada8fc 176 bool Q5 = false;
177 uint32_t sitecode=0, usercode=0, fullcode=0;
6923d3f1 178 uint32_t blocks[5] = {T55x7_MODULATION_MANCHESTER | T55x7_BITRATE_RF_32 | 4<<T55x7_MAXBLOCK_SHIFT | T55x7_ST_TERMINATOR, 0, 0, 0, 5};
179
29ada8fc 180 // get wiegand from printed number.
181 if (GetWiegandFromPresco(Cmd, &sitecode, &usercode, &fullcode, &Q5) == -1) return usage_lf_presco_clone();
182
183 if (Q5)
6f1a5978 184 blocks[0] = T5555_MODULATION_MANCHESTER | ((32-2)>>1)<<T5555_BITRATE_SHIFT | 4<<T5555_MAXBLOCK_SHIFT | T5555_ST_TERMINATOR;
6923d3f1 185
6923d3f1 186 if ((sitecode & 0xFF) != sitecode) {
187 sitecode &= 0xFF;
188 PrintAndLog("Facility-Code Truncated to 8-bits (Presco): %u", sitecode);
189 }
190
191 if ((usercode & 0xFFFF) != usercode) {
192 usercode &= 0xFFFF;
193 PrintAndLog("Card Number Truncated to 16-bits (Presco): %u", usercode);
194 }
195
29ada8fc 196 blocks[1] = 0x10D00000; //preamble
197 blocks[2] = 0x00000000;
198 blocks[3] = 0x00000000;
199 blocks[4] = fullcode;
6923d3f1 200
29ada8fc 201 PrintAndLog("Preparing to clone Presco to T55x7 with SiteCode: %u, UserCode: %u, FullCode: %08x", sitecode, usercode, fullcode);
6923d3f1 202 PrintAndLog("Blk | Data ");
203 PrintAndLog("----+------------");
204 PrintAndLog(" 00 | 0x%08x", blocks[0]);
205 PrintAndLog(" 01 | 0x%08x", blocks[1]);
206 PrintAndLog(" 02 | 0x%08x", blocks[2]);
207 PrintAndLog(" 03 | 0x%08x", blocks[3]);
208 PrintAndLog(" 04 | 0x%08x", blocks[4]);
6923d3f1 209
29ada8fc 210 UsbCommand resp;
211 UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}};
6923d3f1 212
29ada8fc 213 for (int i=4; i>=0; i--) {
214 c.arg[0] = blocks[i];
215 c.arg[1] = i;
216 clearCommandBuffer();
217 SendCommand(&c);
218 if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){
219 PrintAndLog("Error occurred, device did not respond during write operation.");
220 return -1;
221 }
222 }
223 return 0;
224}
6923d3f1 225
29ada8fc 226// takes base 12 ID converts to hex
227// Or takes 8 digit hex ID
228int CmdPrescoSim(const char *Cmd) {
229 uint32_t sitecode=0, usercode=0, fullcode=0;
230 bool Q5=false;
231 // get wiegand from printed number.
232 if (GetWiegandFromPresco(Cmd, &sitecode, &usercode, &fullcode, &Q5) == -1) return usage_lf_presco_sim();
6923d3f1 233
29ada8fc 234 uint8_t clk = 32, encoding = 1, separator = 1, invert = 0;
235 uint16_t arg1, arg2;
236 size_t size = 128;
237 arg1 = clk << 8 | encoding;
238 arg2 = invert << 8 | separator;
6923d3f1 239
29ada8fc 240 PrintAndLog("Simulating Presco - SiteCode: %u, UserCode: %u, FullCode: %08X",sitecode, usercode, fullcode);
6923d3f1 241
29ada8fc 242 UsbCommand c = {CMD_ASK_SIM_TAG, {arg1, arg2, size}};
243 GetPrescoBits(fullcode, c.d.asBytes);
244 clearCommandBuffer();
245 SendCommand(&c);
6923d3f1 246 return 0;
247}
248
249static command_t CommandTable[] = {
29ada8fc 250 {"help", CmdHelp, 1, "This help"},
251 {"read", CmdPrescoRead, 0, "Attempt to read and Extract tag data"},
252 {"clone", CmdPrescoClone, 0, "d <9 digit ID> or h <hex> [Q5] clone presco tag"},
253 {"sim", CmdPrescoSim, 0, "d <9 digit ID> or h <hex> simulate presco tag"},
254 {NULL, NULL, 0, NULL}
6923d3f1 255};
256
257int CmdLFPresco(const char *Cmd) {
258 clearCommandBuffer();
259 CmdsParse(CommandTable, Cmd);
260 return 0;
261}
262
263int CmdHelp(const char *Cmd) {
264 CmdsHelp(CommandTable);
265 return 0;
266}
Impressum, Datenschutz