]>
Commit | Line | Data |
---|---|---|
dbf6e824 CY |
1 | //----------------------------------------------------------------------------- |
2 | // Authored by Craig Young <cyoung@tripwire.com> based on cmdlfhid.c structure | |
3 | // | |
4 | // cmdlfhid.c is Copyright (C) 2010 iZsh <izsh at fail0verflow.com> | |
5 | // | |
6 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, | |
7 | // at your option, any later version. See the LICENSE.txt file for the text of | |
8 | // the license. | |
9 | //----------------------------------------------------------------------------- | |
10 | // Low frequency AWID26 commands | |
b9957414 | 11 | // FSK2a, RF/50, 96 bits (complete) |
dbf6e824 CY |
12 | //----------------------------------------------------------------------------- |
13 | ||
acf0582d | 14 | #include <string.h> |
dbf6e824 CY |
15 | #include <stdio.h> // sscanf |
16 | #include "proxmark3.h" // Definitions, USB controls, etc | |
2b4898ec | 17 | #include "cmdlfawid.h" |
dbf6e824 CY |
18 | #include "ui.h" // PrintAndLog |
19 | #include "cmdparser.h" // CmdsParse, CmdsHelp | |
6cd2eef4 | 20 | #include "lfdemod.h" // parityTest + |
709665b5 | 21 | #include "util.h" // weigandparity |
22 | #include "protocols.h" // for T55xx config register definitions | |
6cd2eef4 | 23 | #include "cmddata.h" // for printDemod and demodbuffer commands |
24 | #include "graph.h" // for getFromGraphBuff cmds | |
976627d5 | 25 | #include "cmdmain.h" |
dbf6e824 | 26 | |
709665b5 | 27 | static int CmdHelp(const char *Cmd); |
bcffcca2 | 28 | |
6cd2eef4 | 29 | int usage_lf_awid_read(void) { |
37824afe MHS |
30 | PrintAndLog("Enables AWID26 compatible reader mode printing details of scanned AWID26 tags."); |
31 | PrintAndLog("By default, values are printed and logged until the button is pressed or another USB command is issued."); | |
32 | PrintAndLog("If the ['1'] option is provided, reader mode is exited after reading a single AWID26 card."); | |
33 | PrintAndLog(""); | |
6cd2eef4 | 34 | PrintAndLog("Usage: lf awid read ['1']"); |
709665b5 | 35 | PrintAndLog("Options : "); |
37824afe MHS |
36 | PrintAndLog(" 1 : (optional) stop after reading a single card"); |
37 | PrintAndLog(""); | |
6cd2eef4 | 38 | PrintAndLog("Samples : lf awid read"); |
39 | PrintAndLog(" : lf awid read 1"); | |
37824afe | 40 | return 0; |
bcffcca2 CY |
41 | } |
42 | ||
43 | int usage_lf_awid_sim(void) { | |
37824afe MHS |
44 | PrintAndLog("Enables simulation of AWID26 card with specified facility-code and card number."); |
45 | PrintAndLog("Simulation runs until the button is pressed or another USB command is issued."); | |
46 | PrintAndLog("Per AWID26 format, the facility-code is 8-bit and the card number is 16-bit. Larger values are truncated."); | |
47 | PrintAndLog(""); | |
48 | PrintAndLog("Usage: lf awid sim <Facility-Code> <Card-Number>"); | |
709665b5 | 49 | PrintAndLog("Options : "); |
37824afe MHS |
50 | PrintAndLog(" <Facility-Code> : 8-bit value representing the AWID facility code"); |
51 | PrintAndLog(" <Card Number> : 16-bit value representing the AWID card number"); | |
52 | PrintAndLog(""); | |
709665b5 | 53 | PrintAndLog("Sample : lf awid sim 224 1337"); |
37824afe | 54 | return 0; |
bcffcca2 CY |
55 | } |
56 | ||
57 | int usage_lf_awid_clone(void) { | |
37824afe MHS |
58 | PrintAndLog("Enables cloning of AWID26 card with specified facility-code and card number onto T55x7."); |
59 | PrintAndLog("The T55x7 must be on the antenna when issuing this command. T55x7 blocks are calculated and printed in the process."); | |
60 | PrintAndLog("Per AWID26 format, the facility-code is 8-bit and the card number is 16-bit. Larger values are truncated."); | |
61 | PrintAndLog(""); | |
62 | PrintAndLog("Usage: lf awid clone <Facility-Code> <Card-Number>"); | |
709665b5 | 63 | PrintAndLog("Options : "); |
37824afe MHS |
64 | PrintAndLog(" <Facility-Code> : 8-bit value representing the AWID facility code"); |
65 | PrintAndLog(" <Card Number> : 16-bit value representing the AWID card number"); | |
709665b5 | 66 | PrintAndLog(" Q5 : optional - clone to Q5 (T5555) instead of T55x7 chip"); |
37824afe | 67 | PrintAndLog(""); |
709665b5 | 68 | PrintAndLog("Sample : lf awid clone 224 1337"); |
37824afe | 69 | return 0; |
bcffcca2 CY |
70 | } |
71 | ||
6cd2eef4 | 72 | int CmdAWIDReadFSK(const char *Cmd) { |
37824afe | 73 | int findone=0; |
6cd2eef4 | 74 | if (Cmd[0] == 'h' || Cmd[0] == 'H') return usage_lf_awid_read(); |
709665b5 | 75 | if (Cmd[0] == '1') findone = 1; |
76 | ||
77 | UsbCommand c = {CMD_AWID_DEMOD_FSK, {findone, 0, 0}}; | |
78 | clearCommandBuffer(); | |
37824afe MHS |
79 | SendCommand(&c); |
80 | return 0; | |
dbf6e824 | 81 | } |
6cd2eef4 | 82 | //by marshmellow |
83 | //AWID Prox demod - FSK RF/50 with preamble of 00000001 (always a 96 bit data stream) | |
84 | //print full AWID Prox ID and some bit format details if found | |
85 | int CmdFSKdemodAWID(const char *Cmd) | |
86 | { | |
87 | uint8_t BitStream[MAX_GRAPH_TRACE_LEN]={0}; | |
88 | size_t size = getFromGraphBuf(BitStream); | |
89 | if (size==0) return 0; | |
90 | ||
1c70664a | 91 | int waveIdx = 0; |
6cd2eef4 | 92 | //get binary from fsk wave |
1c70664a | 93 | int idx = AWIDdemodFSK(BitStream, &size, &waveIdx); |
6cd2eef4 | 94 | if (idx<=0){ |
95 | if (g_debugMode){ | |
96 | if (idx == -1) | |
97 | PrintAndLog("DEBUG: Error - not enough samples"); | |
98 | else if (idx == -2) | |
99 | PrintAndLog("DEBUG: Error - only noise found"); | |
100 | else if (idx == -3) | |
101 | PrintAndLog("DEBUG: Error - problem during FSK demod"); | |
102 | else if (idx == -4) | |
103 | PrintAndLog("DEBUG: Error - AWID preamble not found"); | |
104 | else if (idx == -5) | |
105 | PrintAndLog("DEBUG: Error - Size not correct: %d", size); | |
106 | else | |
107 | PrintAndLog("DEBUG: Error %d",idx); | |
108 | } | |
109 | return 0; | |
110 | } | |
111 | ||
112 | // Index map | |
113 | // 0 10 20 30 40 50 60 | |
114 | // | | | | | | | | |
115 | // 01234567 890 1 234 5 678 9 012 3 456 7 890 1 234 5 678 9 012 3 456 7 890 1 234 5 678 9 012 3 - to 96 | |
116 | // ----------------------------------------------------------------------------- | |
117 | // 00000001 000 1 110 1 101 1 011 1 101 1 010 0 000 1 000 1 010 0 001 0 110 1 100 0 000 1 000 1 | |
118 | // premable bbb o bbb o bbw o fff o fff o ffc o ccc o ccc o ccc o ccc o ccc o wxx o xxx o xxx o - to 96 | |
119 | // |---26 bit---| |-----117----||-------------142-------------| | |
120 | // b = format bit len, o = odd parity of last 3 bits | |
121 | // f = facility code, c = card number | |
122 | // w = wiegand parity | |
123 | // (26 bit format shown) | |
124 | ||
125 | //get raw ID before removing parities | |
126 | uint32_t rawLo = bytebits_to_byte(BitStream+idx+64,32); | |
127 | uint32_t rawHi = bytebits_to_byte(BitStream+idx+32,32); | |
128 | uint32_t rawHi2 = bytebits_to_byte(BitStream+idx,32); | |
129 | setDemodBuf(BitStream,96,idx); | |
1c70664a | 130 | setClockGrid(50, waveIdx + (idx*50)); |
6cd2eef4 | 131 | |
132 | size = removeParity(BitStream, idx+8, 4, 1, 88); | |
133 | if (size != 66){ | |
134 | if (g_debugMode) PrintAndLog("DEBUG: Error - at parity check-tag size does not match AWID format"); | |
135 | return 0; | |
136 | } | |
137 | // ok valid card found! | |
138 | ||
139 | // Index map | |
140 | // 0 10 20 30 40 50 60 | |
141 | // | | | | | | | | |
142 | // 01234567 8 90123456 7890123456789012 3 456789012345678901234567890123456 | |
143 | // ----------------------------------------------------------------------------- | |
144 | // 00011010 1 01110101 0000000010001110 1 000000000000000000000000000000000 | |
145 | // bbbbbbbb w ffffffff cccccccccccccccc w xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx | |
146 | // |26 bit| |-117--| |-----142------| | |
147 | // b = format bit len, o = odd parity of last 3 bits | |
148 | // f = facility code, c = card number | |
149 | // w = wiegand parity | |
150 | // (26 bit format shown) | |
151 | ||
152 | uint32_t fc = 0; | |
153 | uint32_t cardnum = 0; | |
154 | uint32_t code1 = 0; | |
155 | uint32_t code2 = 0; | |
156 | uint8_t fmtLen = bytebits_to_byte(BitStream,8); | |
157 | if (fmtLen==26){ | |
158 | fc = bytebits_to_byte(BitStream+9, 8); | |
159 | cardnum = bytebits_to_byte(BitStream+17, 16); | |
160 | code1 = bytebits_to_byte(BitStream+8,fmtLen); | |
161 | PrintAndLog("AWID Found - BitLength: %d, FC: %d, Card: %d - Wiegand: %x, Raw: %08x%08x%08x", fmtLen, fc, cardnum, code1, rawHi2, rawHi, rawLo); | |
162 | } else { | |
163 | cardnum = bytebits_to_byte(BitStream+8+(fmtLen-17), 16); | |
164 | if (fmtLen>32){ | |
165 | code1 = bytebits_to_byte(BitStream+8,fmtLen-32); | |
166 | code2 = bytebits_to_byte(BitStream+8+(fmtLen-32),32); | |
167 | PrintAndLog("AWID Found - BitLength: %d -unknown BitLength- (%d) - Wiegand: %x%08x, Raw: %08x%08x%08x", fmtLen, cardnum, code1, code2, rawHi2, rawHi, rawLo); | |
168 | } else{ | |
169 | code1 = bytebits_to_byte(BitStream+8,fmtLen); | |
170 | PrintAndLog("AWID Found - BitLength: %d -unknown BitLength- (%d) - Wiegand: %x, Raw: %08x%08x%08x", fmtLen, cardnum, code1, rawHi2, rawHi, rawLo); | |
171 | } | |
172 | } | |
173 | if (g_debugMode){ | |
174 | PrintAndLog("DEBUG: idx: %d, Len: %d Printing Demod Buffer:", idx, 96); | |
175 | printDemodBuff(); | |
176 | } | |
177 | //todo - convert hi2, hi, lo to demodbuffer for future sim/clone commands | |
178 | return 1; | |
179 | } | |
dbf6e824 | 180 | |
709665b5 | 181 | //refactored by marshmellow |
182 | int getAWIDBits(uint32_t fc, uint32_t cn, uint8_t *AWIDBits) { | |
183 | uint8_t pre[66]; | |
184 | memset(pre, 0, sizeof(pre)); | |
185 | AWIDBits[7]=1; | |
186 | num_to_bytebits(26, 8, pre); | |
187 | ||
188 | uint8_t wiegand[24]; | |
189 | num_to_bytebits(fc, 8, wiegand); | |
190 | num_to_bytebits(cn, 16, wiegand+8); | |
191 | ||
192 | wiegand_add_parity(pre+8, wiegand, 24); | |
193 | ||
194 | size_t bitLen = addParity(pre, AWIDBits+8, 66, 4, 1); | |
195 | if (bitLen != 88) return 0; | |
196 | //for (uint8_t i = 0; i<3; i++){ | |
197 | // PrintAndLog("DEBUG: %08X", bytebits_to_byte(AWIDBits+(32*i),32)); | |
198 | //} | |
37824afe | 199 | return 1; |
dbf6e824 CY |
200 | } |
201 | ||
709665b5 | 202 | int CmdAWIDSim(const char *Cmd) { |
203 | uint32_t fcode = 0, cnum = 0, fc=0, cn=0; | |
204 | uint8_t BitStream[96]; | |
205 | uint8_t *bs = BitStream; | |
206 | size_t size = sizeof(BitStream); | |
207 | memset(bs, 0, size); | |
208 | ||
37824afe MHS |
209 | uint64_t arg1 = (10<<8) + 8; // fcHigh = 10, fcLow = 8 |
210 | uint64_t arg2 = 50; // clk RF/50 invert=0 | |
709665b5 | 211 | |
212 | if (sscanf(Cmd, "%u %u", &fc, &cn ) != 2) return usage_lf_awid_sim(); | |
213 | ||
214 | fcode = (fc & 0x000000FF); | |
215 | cnum = (cn & 0x0000FFFF); | |
216 | ||
217 | if (fc != fcode) PrintAndLog("Facility-Code (%u) truncated to 8-bits: %u",fc,fcode); | |
218 | if (cn != cnum) PrintAndLog("Card number (%u) truncated to 16-bits: %u",cn,cnum); | |
37824afe | 219 | |
37824afe MHS |
220 | PrintAndLog("Emulating AWID26 -- FC: %u; CN: %u\n",fcode,cnum); |
221 | PrintAndLog("Press pm3-button to abort simulation or run another command"); | |
709665b5 | 222 | |
223 | if (!getAWIDBits(fc, cn, bs)) { | |
224 | PrintAndLog("Error with tag bitstream generation."); | |
225 | return 1; | |
226 | } | |
37824afe | 227 | // AWID uses: fcHigh: 10, fcLow: 8, clk: 50, invert: 0 |
709665b5 | 228 | UsbCommand c = {CMD_FSK_SIM_TAG, {arg1, arg2, size}}; |
229 | memcpy(c.d.asBytes, bs, size); | |
230 | clearCommandBuffer(); | |
37824afe MHS |
231 | SendCommand(&c); |
232 | return 0; | |
dbf6e824 CY |
233 | } |
234 | ||
709665b5 | 235 | int CmdAWIDClone(const char *Cmd) { |
236 | uint32_t blocks[4] = {T55x7_MODULATION_FSK2a | T55x7_BITRATE_RF_50 | 3<<T55x7_MAXBLOCK_SHIFT, 0, 0, 0}; | |
237 | uint32_t fc=0,cn=0; | |
238 | uint8_t BitStream[96]; | |
239 | uint8_t *bs=BitStream; | |
240 | memset(bs,0,sizeof(BitStream)); | |
37824afe | 241 | |
709665b5 | 242 | if (sscanf(Cmd, "%u %u", &fc, &cn ) != 2) return usage_lf_awid_clone(); |
243 | ||
244 | if (param_getchar(Cmd, 3) == 'Q' || param_getchar(Cmd, 3) == 'q') | |
6f1a5978 | 245 | blocks[0] = T5555_MODULATION_FSK2 | T5555_INVERT_OUTPUT | ((50-2)>>1)<<T5555_BITRATE_SHIFT | 3<<T5555_MAXBLOCK_SHIFT; |
37824afe MHS |
246 | |
247 | if ((fc & 0xFF) != fc) { | |
248 | fc &= 0xFF; | |
249 | PrintAndLog("Facility-Code Truncated to 8-bits (AWID26): %u", fc); | |
250 | } | |
251 | if ((cn & 0xFFFF) != cn) { | |
252 | cn &= 0xFFFF; | |
253 | PrintAndLog("Card Number Truncated to 16-bits (AWID26): %u", cn); | |
254 | } | |
976627d5 | 255 | |
709665b5 | 256 | if ( !getAWIDBits(fc, cn, bs)) { |
257 | PrintAndLog("Error with tag bitstream generation."); | |
258 | return 1; | |
259 | } | |
260 | ||
261 | blocks[1] = bytebits_to_byte(bs,32); | |
262 | blocks[2] = bytebits_to_byte(bs+32,32); | |
263 | blocks[3] = bytebits_to_byte(bs+64,32); | |
264 | ||
265 | PrintAndLog("Preparing to clone AWID26 to T55x7 with FC: %u, CN: %u", | |
266 | fc, cn); | |
267 | PrintAndLog("Blk | Data "); | |
268 | PrintAndLog("----+------------"); | |
269 | PrintAndLog(" 00 | 0x%08x", blocks[0]); | |
270 | PrintAndLog(" 01 | 0x%08x", blocks[1]); | |
271 | PrintAndLog(" 02 | 0x%08x", blocks[2]); | |
272 | PrintAndLog(" 03 | 0x%08x", blocks[3]); | |
273 | ||
274 | UsbCommand resp; | |
275 | UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}}; | |
276 | ||
277 | for (uint8_t i=0; i<4; i++) { | |
278 | c.cmd = CMD_T55XX_WRITE_BLOCK; | |
279 | c.arg[0] = blocks[i]; | |
280 | c.arg[1] = i; | |
281 | c.arg[2] = 0; | |
282 | clearCommandBuffer(); | |
283 | SendCommand(&c); | |
284 | if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){ | |
285 | PrintAndLog("Error occurred, device did not respond during write operation."); | |
286 | return -1; | |
37824afe | 287 | } |
709665b5 | 288 | |
37824afe MHS |
289 | } |
290 | return 0; | |
dbf6e824 CY |
291 | } |
292 | ||
709665b5 | 293 | static command_t CommandTable[] = { |
294 | {"help", CmdHelp, 1, "This help"}, | |
6cd2eef4 | 295 | {"demod", CmdFSKdemodAWID, 1, "Demodulate an AWID FSK tag from the GraphBuffer"}, |
296 | {"read", CmdAWIDReadFSK, 0, "['1'] Realtime AWID FSK read from the antenna (option '1' for one tag only)"}, | |
37824afe | 297 | {"sim", CmdAWIDSim, 0, "<Facility-Code> <Card Number> -- AWID tag simulator"}, |
709665b5 | 298 | {"clone", CmdAWIDClone, 0, "<Facility-Code> <Card Number> <Q5> -- Clone AWID to T55x7 (tag must be in range of antenna)"}, |
37824afe | 299 | {NULL, NULL, 0, NULL} |
dbf6e824 CY |
300 | }; |
301 | ||
709665b5 | 302 | int CmdLFAWID(const char *Cmd) { |
37824afe MHS |
303 | CmdsParse(CommandTable, Cmd); |
304 | return 0; | |
dbf6e824 CY |
305 | } |
306 | ||
709665b5 | 307 | int CmdHelp(const char *Cmd) { |
37824afe MHS |
308 | CmdsHelp(CommandTable); |
309 | return 0; | |
dbf6e824 | 310 | } |