[proxmark3-svn] / client / cmdlfvisa2000.c

//-----------------------------------------------------------------------------
//
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
// at your option, any later version. See the LICENSE.txt file for the text of
// the license.
//-----------------------------------------------------------------------------
// Low frequency visa 200 tag commands
// by iceman
//-----------------------------------------------------------------------------

#include "cmdlfvisa2000.h"
#include "proxmark3.h"
#include "ui.h"
#include "util.h"
#include "graph.h"
#include "cmddata.h"    // for ASKDemod_ext, g_debugMode, DemodBuffer ...
#include "cmdmain.h"    // for clearCommandBuffer and WaitForResponseTimeout
#include "cmdlf.h"
#include "protocols.h"  // for T55xx config register definitions
#include "lfdemod.h"    // for Visa2kDemod_AM

#define BL0CK1 0x56495332

static int CmdHelp(const char *Cmd);

int usage_lf_visa2k_clone(void){
	PrintAndLog("clone a Visa2000 tag to a T55x7 tag.");
	PrintAndLog("Usage: lf visa2k clone [h] <card ID> <Q5>");
	PrintAndLog("Options:");
	PrintAndLog("      h          : This help");
	PrintAndLog("      <card ID>  : Visa2k card ID");
	PrintAndLog("      <Q5>       : specify write to Q5 (t5555 instead of t55x7)");
	PrintAndLog("");
	PrintAndLog("Sample: lf visa2k clone 112233");
	return 0;
}

int usage_lf_visa2k_sim(void) {
	PrintAndLog("Enables simulation of visa2k card with specified card number.");
	PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
	PrintAndLog("");
	PrintAndLog("Usage:  lf visa2k sim [h] <card ID>");
	PrintAndLog("Options:");
	PrintAndLog("      h          : This help");
	PrintAndLog("      <card ID>  : Visa2k card ID");
	PrintAndLog("");
	PrintAndLog("Sample: lf visa2k sim 112233");
	return 0;
}

static uint8_t visa_chksum( uint32_t id ) {
	uint8_t sum = 0;
	for (uint8_t i = 0; i < 32; i += 4)
		sum ^=  (id >> i) & 0xF;

	return sum;
}

static uint8_t visa_parity( uint32_t id) {
	// 4bit parity LUT
	uint8_t par_lut[] = {
		 0,1,1,0
		,1,0,0,1
		,1,0,0,1
		,0,1,1,0
	};
	uint8_t par = 0;
	par |= par_lut[ (id >> 28) & 0xF ] << 7;
	par |= par_lut[ (id >> 24) & 0xF ] << 6;
	par |= par_lut[ (id >> 20) & 0xF ] << 5;
	par |= par_lut[ (id >> 16) & 0xF ] << 4;
	par |= par_lut[ (id >> 12) & 0xF ] << 3;
	par |= par_lut[ (id >>  8) & 0xF ] << 2;
	par |= par_lut[ (id >>  4) & 0xF ] << 1;
	par |= par_lut[ (id & 0xF) ];
	return par;	
}


/**
*
* 56495332 00096ebd 00000077 —> tag id 618173
* aaaaaaaa iiiiiiii -----..c
*
* a = fixed value  ascii 'VIS2'
* i = card id
* c = checksum  (xor of card id)
* . = unknown 
* 
**/
//see ASKDemod for what args are accepted
int CmdVisa2kDemod(const char *Cmd) {

	//sCmdAskEdgeDetect("");

	//ASK / Manchester
	bool st = true;
	if (!ASKDemod_ext("64 0 0", false, false, 1, &st)) {
		if (g_debugMode) PrintAndLog("DEBUG: Error - Visa2k: ASK/Manchester Demod failed");
		return 0;
	}
	size_t size = DemodBufferLen;
	int ans = Visa2kDemod_AM(DemodBuffer, &size);
	if (ans < 0){
		if (g_debugMode){
			if (ans == -1)
				PrintAndLog("DEBUG: Error - Visa2k: too few bits found");
			else if (ans == -2)
				PrintAndLog("DEBUG: Error - Visa2k: preamble not found");
			else if (ans == -3)
				PrintAndLog("DEBUG: Error - Visa2k: Size not correct: %d", size);
			else
				PrintAndLog("DEBUG: Error - Visa2k: ans: %d", ans);
		}
		return 0;
	}
	setDemodBuf(DemodBuffer, 96, ans);
	//setGrid_Clock(64);

	//got a good demod
	uint32_t raw1 = bytebits_to_byte(DemodBuffer, 32);
	uint32_t raw2 = bytebits_to_byte(DemodBuffer+32, 32);
	uint32_t raw3 = bytebits_to_byte(DemodBuffer+64, 32);

	// chksum
	uint8_t calc = visa_chksum(raw2);
	uint8_t chk = raw3 & 0xF;	

	// test checksums
	if ( chk != calc ) { 
		printf("DEBUG: error: Visa2000 checksum failed %x - %x\n", chk, calc);
		return 0;
	}
	// parity
	uint8_t calc_par = visa_parity(raw2);
	uint8_t chk_par = (raw3 & 0xFF0) >> 4;
	if ( calc_par != chk_par) {
		printf("DEBUG: error: Visa2000 parity failed %x - %x\n", chk_par, calc_par);
		return 0;
	}
	PrintAndLog("Visa2000 Tag Found: Card ID %u,  Raw: %08X%08X%08X", raw2,  raw1 ,raw2, raw3);
	return 1;
}

int CmdVisa2kRead(const char *Cmd) {
	CmdLFRead("s");
	//64*96*2=12288 samples just in case we just missed the first preamble we can still catch 2 of them
	getSamples("12500",true); 
	return CmdVisa2kDemod(Cmd);
}

int CmdVisa2kClone(const char *Cmd) {

	uint64_t id = 0;
	uint32_t blocks[4] = {T55x7_MODULATION_MANCHESTER | T55x7_BITRATE_RF_64 | T55x7_ST_TERMINATOR | 3 << T55x7_MAXBLOCK_SHIFT, BL0CK1, 0};

	char cmdp = param_getchar(Cmd, 0);
	if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_visa2k_clone();

	id = param_get32ex(Cmd, 0, 0, 10);
	
	//Q5
	if (param_getchar(Cmd, 1) == 'Q' || param_getchar(Cmd, 1) == 'q') {
		//t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
		blocks[0] = T5555_MODULATION_MANCHESTER | ((64-2)>>1) << T5555_BITRATE_SHIFT | T5555_ST_TERMINATOR | 3 << T5555_MAXBLOCK_SHIFT;
	}

	blocks[2] = id;
	blocks[3] = (visa_parity(id) << 4) | visa_chksum(id);

	PrintAndLog("Preparing to clone Visa2000 to T55x7 with CardId: %u", id);
	PrintAndLog("Blk | Data ");
	PrintAndLog("----+------------");
	for(int i = 0; i<4; ++i)
		PrintAndLog(" %02d | 0x%08x", i , blocks[i]);
	
	UsbCommand resp;
	UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}};

	for (int i = 3; i >= 0; --i) {
		c.arg[0] = blocks[i];
		c.arg[1] = i;
		clearCommandBuffer();
		SendCommand(&c);
		if (!WaitForResponseTimeout(CMD_ACK, &resp, T55XX_WRITE_TIMEOUT)){
			PrintAndLog("Error occurred, device did not respond during write operation.");
			return -1;
		}
	}
	return 0;
}

int CmdVisa2kSim(const char *Cmd) {

	uint32_t id = 0;
	char cmdp = param_getchar(Cmd, 0);
	if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_visa2k_sim();

	id = param_get32ex(Cmd, 0, 0, 10);

	uint8_t clk = 64, encoding = 1, separator = 1, invert = 0;
	uint16_t arg1, arg2;
	size_t size = 96;
	arg1 = clk << 8 | encoding;
	arg2 = invert << 8 | separator;

	PrintAndLog("Simulating Visa2000 - CardId: %u", id);

	UsbCommand c = {CMD_ASK_SIM_TAG, {arg1, arg2, size}};

	uint32_t blocks[3] = { BL0CK1, id, (visa_parity(id) << 4) | visa_chksum(id) };

	for(int i=0; i<3; ++i)
		num_to_bytebits(blocks[i], 32, c.d.asBytes + i*32);

	clearCommandBuffer();
	SendCommand(&c);
	return 0;
}

static command_t CommandTable[] = {
	{"help",  CmdHelp,        1, "This help"},
	{"demod", CmdVisa2kDemod, 1, "Attempt to demod from GraphBuffer"},
	{"read",  CmdVisa2kRead,  0, "Attempt to read and extract tag data"},
	{"clone", CmdVisa2kClone, 0, "clone Visa2000 tag"},
	{"sim",   CmdVisa2kSim,   0, "simulate Visa2000 tag"},
	{NULL, NULL, 0, NULL}
};

int CmdLFVisa2k(const char *Cmd) {
	clearCommandBuffer();
	CmdsParse(CommandTable, Cmd);
	return 0;
}

int CmdHelp(const char *Cmd) {
	CmdsHelp(CommandTable);
	return 0;
}
Commit	Line	Data
8b6abef5	1	//-----------------------------------------------------------------------------
	2	//
	3	// This code is licensed to you under the terms of the GNU GPL, version 2 or,
	4	// at your option, any later version. See the LICENSE.txt file for the text of
	5	// the license.
	6	//-----------------------------------------------------------------------------
	7	// Low frequency visa 200 tag commands
	8	// by iceman
	9	//-----------------------------------------------------------------------------
	10
	11	#include "cmdlfvisa2000.h"
	12	#include "proxmark3.h"
	13	#include "ui.h"
	14	#include "util.h"
	15	#include "graph.h"
	16	#include "cmddata.h" // for ASKDemod_ext, g_debugMode, DemodBuffer ...
	17	#include "cmdmain.h" // for clearCommandBuffer and WaitForResponseTimeout
	18	#include "cmdlf.h"
	19	#include "protocols.h" // for T55xx config register definitions
	20	#include "lfdemod.h" // for Visa2kDemod_AM
	21
	22	#define BL0CK1 0x56495332
	23
	24	static int CmdHelp(const char *Cmd);
	25
	26	int usage_lf_visa2k_clone(void){
	27	PrintAndLog("clone a Visa2000 tag to a T55x7 tag.");
	28	PrintAndLog("Usage: lf visa2k clone [h] <card ID> <Q5>");
	29	PrintAndLog("Options:");
	30	PrintAndLog(" h : This help");
	31	PrintAndLog(" <card ID> : Visa2k card ID");
	32	PrintAndLog(" <Q5> : specify write to Q5 (t5555 instead of t55x7)");
	33	PrintAndLog("");
	34	PrintAndLog("Sample: lf visa2k clone 112233");
	35	return 0;
	36	}
	37
	38	int usage_lf_visa2k_sim(void) {
	39	PrintAndLog("Enables simulation of visa2k card with specified card number.");
	40	PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
	41	PrintAndLog("");
	42	PrintAndLog("Usage: lf visa2k sim [h] <card ID>");
	43	PrintAndLog("Options:");
	44	PrintAndLog(" h : This help");
	45	PrintAndLog(" <card ID> : Visa2k card ID");
	46	PrintAndLog("");
	47	PrintAndLog("Sample: lf visa2k sim 112233");
	48	return 0;
	49	}
	50
	51	static uint8_t visa_chksum( uint32_t id ) {
	52	uint8_t sum = 0;
	53	for (uint8_t i = 0; i < 32; i += 4)
	54	sum ^= (id >> i) & 0xF;
	55
	56	return sum;
	57	}
	58
	59	static uint8_t visa_parity( uint32_t id) {
	60	// 4bit parity LUT
	61	uint8_t par_lut[] = {
	62	0,1,1,0
	63	,1,0,0,1
	64	,1,0,0,1
65	,0,1,1,0
66	};
67	uint8_t par = 0;
68	par \|= par_lut[ (id >> 28) & 0xF ] << 7;
69	par \|= par_lut[ (id >> 24) & 0xF ] << 6;
70	par \|= par_lut[ (id >> 20) & 0xF ] << 5;
71	par \|= par_lut[ (id >> 16) & 0xF ] << 4;
72	par \|= par_lut[ (id >> 12) & 0xF ] << 3;
73	par \|= par_lut[ (id >> 8) & 0xF ] << 2;
74	par \|= par_lut[ (id >> 4) & 0xF ] << 1;
75	par \|= par_lut[ (id & 0xF) ];
76	return par;
77	}
78
79
80	/**
81	*
82	* 56495332 00096ebd 00000077 —> tag id 618173
83	* aaaaaaaa iiiiiiii -----..c
84	*
85	* a = fixed value ascii 'VIS2'
86	* i = card id
87	* c = checksum (xor of card id)
88	* . = unknown
89	*
90	**/
91	//see ASKDemod for what args are accepted
92	int CmdVisa2kDemod(const char *Cmd) {
93
94	//sCmdAskEdgeDetect("");
95
96	//ASK / Manchester
97	bool st = true;
98	if (!ASKDemod_ext("64 0 0", false, false, 1, &st)) {
99	if (g_debugMode) PrintAndLog("DEBUG: Error - Visa2k: ASK/Manchester Demod failed");
100	return 0;
101	}
102	size_t size = DemodBufferLen;
103	int ans = Visa2kDemod_AM(DemodBuffer, &size);
104	if (ans < 0){
105	if (g_debugMode){
106	if (ans == -1)
107	PrintAndLog("DEBUG: Error - Visa2k: too few bits found");
108	else if (ans == -2)
109	PrintAndLog("DEBUG: Error - Visa2k: preamble not found");
110	else if (ans == -3)
111	PrintAndLog("DEBUG: Error - Visa2k: Size not correct: %d", size);
112	else
113	PrintAndLog("DEBUG: Error - Visa2k: ans: %d", ans);
114	}
115	return 0;
116	}
117	setDemodBuf(DemodBuffer, 96, ans);
118	//setGrid_Clock(64);
119
120	//got a good demod
121	uint32_t raw1 = bytebits_to_byte(DemodBuffer, 32);
122	uint32_t raw2 = bytebits_to_byte(DemodBuffer+32, 32);
123	uint32_t raw3 = bytebits_to_byte(DemodBuffer+64, 32);
124
125	// chksum
126	uint8_t calc = visa_chksum(raw2);
127	uint8_t chk = raw3 & 0xF;
128
129	// test checksums
130	if ( chk != calc ) {
131	printf("DEBUG: error: Visa2000 checksum failed %x - %x\n", chk, calc);
132	return 0;
133	}
134	// parity
135	uint8_t calc_par = visa_parity(raw2);
136	uint8_t chk_par = (raw3 & 0xFF0) >> 4;
137	if ( calc_par != chk_par) {
138	printf("DEBUG: error: Visa2000 parity failed %x - %x\n", chk_par, calc_par);
139	return 0;
140	}
141	PrintAndLog("Visa2000 Tag Found: Card ID %u, Raw: %08X%08X%08X", raw2, raw1 ,raw2, raw3);
142	return 1;
143	}
144
145	int CmdVisa2kRead(const char *Cmd) {
146	CmdLFRead("s");
147	//64962=12288 samples just in case we just missed the first preamble we can still catch 2 of them
148	getSamples("12500",true);
149	return CmdVisa2kDemod(Cmd);
150	}
151
152	int CmdVisa2kClone(const char *Cmd) {
153
154	uint64_t id = 0;
155	uint32_t blocks[4] = {T55x7_MODULATION_MANCHESTER \| T55x7_BITRATE_RF_64 \| T55x7_ST_TERMINATOR \| 3 << T55x7_MAXBLOCK_SHIFT, BL0CK1, 0};
156
157	char cmdp = param_getchar(Cmd, 0);
158	if (strlen(Cmd) == 0 \|\| cmdp == 'h' \|\| cmdp == 'H') return usage_lf_visa2k_clone();
159
160	id = param_get32ex(Cmd, 0, 0, 10);
161
162	//Q5
163	if (param_getchar(Cmd, 1) == 'Q' \|\| param_getchar(Cmd, 1) == 'q') {
164	//t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
165	blocks[0] = T5555_MODULATION_MANCHESTER \| ((64-2)>>1) << T5555_BITRATE_SHIFT \| T5555_ST_TERMINATOR \| 3 << T5555_MAXBLOCK_SHIFT;
166	}
167
168	blocks[2] = id;
169	blocks[3] = (visa_parity(id) << 4) \| visa_chksum(id);
170
171	PrintAndLog("Preparing to clone Visa2000 to T55x7 with CardId: %u", id);
172	PrintAndLog("Blk \| Data ");
173	PrintAndLog("----+------------");
174	for(int i = 0; i<4; ++i)
175	PrintAndLog(" %02d \| 0x%08x", i , blocks[i]);
176
177	UsbCommand resp;
178	UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}};
179
180	for (int i = 3; i >= 0; --i) {
181	c.arg[0] = blocks[i];
182	c.arg[1] = i;
183	clearCommandBuffer();
184	SendCommand(&c);
185	if (!WaitForResponseTimeout(CMD_ACK, &resp, T55XX_WRITE_TIMEOUT)){
186	PrintAndLog("Error occurred, device did not respond during write operation.");
187	return -1;
188	}
189	}
190	return 0;
191	}
192
193	int CmdVisa2kSim(const char *Cmd) {
194
195	uint32_t id = 0;
196	char cmdp = param_getchar(Cmd, 0);
197	if (strlen(Cmd) == 0 \|\| cmdp == 'h' \|\| cmdp == 'H') return usage_lf_visa2k_sim();
198
199	id = param_get32ex(Cmd, 0, 0, 10);
200
201	uint8_t clk = 64, encoding = 1, separator = 1, invert = 0;
202	uint16_t arg1, arg2;
203	size_t size = 96;
204	arg1 = clk << 8 \| encoding;
205	arg2 = invert << 8 \| separator;
206
207	PrintAndLog("Simulating Visa2000 - CardId: %u", id);
208
209	UsbCommand c = {CMD_ASK_SIM_TAG, {arg1, arg2, size}};
210
211	uint32_t blocks[3] = { BL0CK1, id, (visa_parity(id) << 4) \| visa_chksum(id) };
212
213	for(int i=0; i<3; ++i)
214	num_to_bytebits(blocks[i], 32, c.d.asBytes + i*32);
215
216	clearCommandBuffer();
217	SendCommand(&c);
218	return 0;
219	}
220
221	static command_t CommandTable[] = {
222	{"help", CmdHelp, 1, "This help"},
223	{"demod", CmdVisa2kDemod, 1, "Attempt to demod from GraphBuffer"},
224	{"read", CmdVisa2kRead, 0, "Attempt to read and extract tag data"},
225	{"clone", CmdVisa2kClone, 0, "clone Visa2000 tag"},
226	{"sim", CmdVisa2kSim, 0, "simulate Visa2000 tag"},
227	{NULL, NULL, 0, NULL}
228	};
229
230	int CmdLFVisa2k(const char *Cmd) {
231	clearCommandBuffer();
232	CmdsParse(CommandTable, Cmd);
233	return 0;
234	}
235
236	int CmdHelp(const char *Cmd) {
237	CmdsHelp(CommandTable);
238	return 0;
239	}