git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfpyramid.c

   1 //-----------------------------------------------------------------------------
   2 //
   3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   4 // at your option, any later version. See the LICENSE.txt file for the text of
   5 // the license.
   6 //-----------------------------------------------------------------------------
   7 // Low frequency Farpoint / Pyramid tag commands
   8 //-----------------------------------------------------------------------------
   9 #include <string.h>
  10 #include <inttypes.h>
  11 #include <stdio.h>
  12 #include "cmdlfpyramid.h"
  13 #include "proxmark3.h"
  14 #include "ui.h"
  15 #include "util.h"
  16 #include "graph.h"
  17 #include "cmdparser.h"
  18 #include "cmddata.h"
  19 #include "cmdmain.h"
  20 #include "cmdlf.h"
  21 #include "protocols.h"  // for T55xx config register definitions
  22 #include "lfdemod.h"    // parityTest
  23 #include "crc.h"
  24
  25 static int CmdHelp(const char *Cmd);
  26
  27 int usage_lf_pyramid_clone(void){
  28         PrintAndLog("clone a Farpointe/Pyramid tag to a T55x7 tag.");
  29         PrintAndLog("The facility-code is 8-bit and the card number is 16-bit.  Larger values are truncated. ");
  30         PrintAndLog("Currently work only on 26bit");
  31         PrintAndLog("");
  32         PrintAndLog("Usage: lf pyramid clone <Facility-Code> <Card-Number>");
  33         PrintAndLog("Options :");
  34         PrintAndLog("  <Facility-Code> :  8-bit value facility code");
  35         PrintAndLog("  <Card Number>   : 16-bit value card number");
  36         PrintAndLog("  Q5              : optional - clone to Q5 (T5555) instead of T55x7 chip");
  37         PrintAndLog("");
  38         PrintAndLog("Sample  : lf pyramid clone 123 11223");
  39         return 0;
  40 }
  41
  42 int usage_lf_pyramid_sim(void) {
  43         PrintAndLog("Enables simulation of Farpointe/Pyramid card with specified card number.");
  44         PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
  45         PrintAndLog("The facility-code is 8-bit and the card number is 16-bit.  Larger values are truncated.");
  46         PrintAndLog("Currently work only on 26bit");
  47         PrintAndLog("");
  48         PrintAndLog("Usage:  lf pyramid sim <Card-Number>");
  49         PrintAndLog("Options :");
  50         PrintAndLog("  <Facility-Code> :  8-bit value facility code");
  51         PrintAndLog("  <Card Number>   : 16-bit value card number");
  52         PrintAndLog("");
  53         PrintAndLog("Sample  : lf pyramid sim 123 11223");
  54         return 0;
  55 }
  56
  57 // Works for 26bits.
  58 int GetPyramidBits(uint32_t fc, uint32_t cn, uint8_t *pyramidBits) {
  59
  60         uint8_t pre[128];
  61         memset(pre, 0x00, sizeof(pre));
  62
  63         // format start bit
  64         pre[79] = 1;
  65
  66         // Get 26 wiegand from FacilityCode, CardNumber
  67         uint8_t wiegand[24];
  68         memset(wiegand, 0x00, sizeof(wiegand));
  69         num_to_bytebits(fc, 8, wiegand);
  70         num_to_bytebits(cn, 16, wiegand+8);
  71
  72         // add wiegand parity bits (dest, source, len)
  73         wiegand_add_parity(pre+80, wiegand, 24);
  74
  75         // add paritybits       (bitsource, dest, sourcelen, paritylen, parityType (odd, even,)
  76         addParity(pre+8, pyramidBits+8, 102, 8, 1);
  77
  78         // add checksum
  79         uint8_t csBuff[13];
  80         for (uint8_t i = 0; i < 13; i++)
  81                 csBuff[i] = bytebits_to_byte(pyramidBits + 16 + (i*8), 8);
  82
  83         uint32_t crc = CRC8Maxim(csBuff, 13);
  84         num_to_bytebits(crc, 8, pyramidBits+120);
  85         return 1;
  86 }
  87
  88 int CmdPyramidRead(const char *Cmd) {
  89         CmdLFRead("s");
  90         getSamples("30000",false);
  91         return CmdFSKdemodPyramid("");
  92 }
  93
  94 int CmdPyramidClone(const char *Cmd) {
  95
  96         char cmdp = param_getchar(Cmd, 0);
  97         if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_pyramid_clone();
  98
  99         uint32_t facilitycode=0, cardnumber=0, fc = 0, cn = 0;
 100         uint32_t blocks[5];
 101         uint8_t i;
 102         uint8_t bs[128];
 103         memset(bs, 0x00, sizeof(bs));
 104
 105         if (sscanf(Cmd, "%u %u", &fc, &cn ) != 2) return usage_lf_pyramid_clone();
 106
 107         facilitycode = (fc & 0x000000FF);
 108         cardnumber = (cn & 0x0000FFFF);
 109
 110         if ( !GetPyramidBits(facilitycode, cardnumber, bs)) {
 111                 PrintAndLog("Error with tag bitstream generation.");
 112                 return 1;
 113         }
 114
 115         //Pyramid - compat mode, FSK2a, data rate 50, 4 data blocks
 116         blocks[0] = T55x7_MODULATION_FSK2a | T55x7_BITRATE_RF_50 | 4<<T55x7_MAXBLOCK_SHIFT;
 117
 118         if (param_getchar(Cmd, 3) == 'Q' || param_getchar(Cmd, 3) == 'q')
 119                 blocks[0] = T5555_MODULATION_FSK2 | T5555_INVERT_OUTPUT | 50<<T5555_BITRATE_SHIFT | 4<<T5555_MAXBLOCK_SHIFT;
 120
 121         blocks[1] = bytebits_to_byte(bs,32);
 122         blocks[2] = bytebits_to_byte(bs+32,32);
 123         blocks[3] = bytebits_to_byte(bs+64,32);
 124         blocks[4] = bytebits_to_byte(bs+96,32);
 125
 126         PrintAndLog("Preparing to clone Farpointe/Pyramid to T55x7 with Facility Code: %u, Card Number: %u", facilitycode, cardnumber);
 127         PrintAndLog("Blk | Data ");
 128         PrintAndLog("----+------------");
 129         for ( i = 0; i<5; ++i )
 130                 PrintAndLog(" %02d | %08" PRIx32, i, blocks[i]);
 131
 132         UsbCommand resp;
 133         UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}};
 134
 135         for ( i = 0; i<5; ++i ) {
 136                 c.arg[0] = blocks[i];
 137                 c.arg[1] = i;
 138                 clearCommandBuffer();
 139                 SendCommand(&c);
 140                 if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){
 141                         PrintAndLog("Error occurred, device did not respond during write operation.");
 142                         return -1;
 143                 }
 144         }
 145         return 0;
 146 }
 147
 148 int CmdPyramidSim(const char *Cmd) {
 149
 150         char cmdp = param_getchar(Cmd, 0);
 151         if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_pyramid_sim();
 152
 153         uint32_t facilitycode = 0, cardnumber = 0, fc = 0, cn = 0;
 154
 155         uint8_t bs[128];
 156         size_t size = sizeof(bs);
 157         memset(bs, 0x00, size);
 158
 159         // Pyramid uses:  fcHigh: 10, fcLow: 8, clk: 50, invert: 0
 160         uint64_t arg1, arg2;
 161         arg1 = (10 << 8) + 8;
 162         arg2 = 50 | 0;
 163
 164         if (sscanf(Cmd, "%u %u", &fc, &cn ) != 2) return usage_lf_pyramid_sim();
 165
 166         facilitycode = (fc & 0x000000FF);
 167         cardnumber = (cn & 0x0000FFFF);
 168
 169         if ( !GetPyramidBits(facilitycode, cardnumber, bs)) {
 170                 PrintAndLog("Error with tag bitstream generation.");
 171                 return 1;
 172         }
 173
 174         PrintAndLog("Simulating Farpointe/Pyramid - Facility Code: %u, CardNumber: %u", facilitycode, cardnumber );
 175
 176         UsbCommand c = {CMD_FSK_SIM_TAG, {arg1, arg2, size}};
 177         memcpy(c.d.asBytes, bs, size);
 178         clearCommandBuffer();
 179         SendCommand(&c);
 180         return 0;
 181 }
 182
 183 static command_t CommandTable[] = {
 184         {"help",  CmdHelp,         1, "This help"},
 185         {"read",  CmdPyramidRead,  0, "Attempt to read and extract tag data"},
 186         {"clone", CmdPyramidClone, 0, "<Facility-Code> <Card Number>  clone pyramid tag"},
 187         {"sim",   CmdPyramidSim,   0, "<Facility-Code> <Card Number>  simulate pyramid tag"},
 188         {NULL, NULL, 0, NULL}
 189 };
 190
 191 int CmdLFPyramid(const char *Cmd) {
 192         clearCommandBuffer();
 193         CmdsParse(CommandTable, Cmd);
 194         return 0;
 195 }
 196
 197 int CmdHelp(const char *Cmd) {
 198         CmdsHelp(CommandTable);
 199         return 0;
 200 }