git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfnedap.c

   1 //-----------------------------------------------------------------------------
   2 //
   3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   4 // at your option, any later version. See the LICENSE.txt file for the text of
   5 // the license.
   6 //-----------------------------------------------------------------------------
   7 // Low frequency NEDAP tag commands
   8 //-----------------------------------------------------------------------------
   9 #include <string.h>
  10 #include <inttypes.h>
  11 #include "cmdlfnedap.h"
  12 static int CmdHelp(const char *Cmd);
  13
  14 int usage_lf_nedap_clone(void){
  15         PrintAndLog("clone a NEDAP tag to a T55x7 tag.");
  16         PrintAndLog("");
  17         PrintAndLog("Usage: lf nedap clone [h] <Card-Number>");
  18         PrintAndLog("Options:");
  19         PrintAndLog("      h             : This help");
  20         PrintAndLog("      <Card Number> : 24-bit value card number");
  21 //      PrintAndLog("      Q5            : optional - clone to Q5 (T5555) instead of T55x7 chip");
  22         PrintAndLog("");
  23         PrintAndLog("Sample: lf nedap clone 112233");
  24         return 0;
  25 }
  26
  27 int usage_lf_nedap_sim(void) {
  28         PrintAndLog("Enables simulation of NEDAP card with specified card number.");
  29         PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
  30         PrintAndLog("");
  31         PrintAndLog("Usage:  lf nedap sim [h] <Card-Number>");
  32         PrintAndLog("Options:");
  33         PrintAndLog("      h               : This help");
  34         PrintAndLog("      <Card Number>   : 24-bit value card number");
  35         PrintAndLog("");
  36         PrintAndLog("Sample: lf nedap sim 112233");
  37         return 0;
  38 }
  39
  40 int GetNedapBits(uint32_t cn, uint8_t *nedapBits) {
  41
  42         uint8_t pre[128];
  43         memset(pre, 0x00, sizeof(pre));
  44
  45         // preamble  1111 1111 10 = 0XF8
  46         num_to_bytebits(0xF8, 10, pre);
  47
  48         // fixed tagtype code?  0010 1101 = 0x2D
  49         num_to_bytebits(0x2D, 8, pre+10);
  50
  51         // 46 encrypted bits - UNKNOWN ALGO
  52         //    -- 16 bits checksum. Should be 4x4 checksum,  based on UID and 2 constant values.
  53         //    -- 30 bits undocumented?
  54         num_to_bytebits(cn, 46, pre+18);
  55
  56         //----from this part, the UID in clear text, with a 1bit ZERO as separator between bytes.
  57         pre[64] = 0;
  58
  59         // cardnumber (uid)
  60         num_to_bytebits(cn, 24, pre+64);
  61
  62         pre[73] = 0;
  63         pre[82] = 0;
  64         pre[91] = 0;
  65         pre[100] = 0;
  66         pre[109] = 0;
  67         pre[118] = 0;
  68
  69         // add paritybits       (bitsource, dest, sourcelen, paritylen, parityType (odd, even,)
  70         addParity(pre+64, pre+64, 128, 8, 1);
  71
  72 //1111111110001011010000010110100011001001000010110101001101011001000110011010010000000000100001110001001000000001000101011100111
  73         return 1;
  74 }
  75 /*
  76  - UID: 001630
  77  - i: 4071
  78  - Checksum2 BE21
  79 */
  80 //GetParity( uint8_t *bits, uint8_t type, int length)
  81
  82 //NEDAP demod - ASK/Biphase (or Diphase),  RF/64 with preamble of 1111111110  (always a 128 bit data stream)
  83 //print NEDAP Prox ID, encoding, encrypted ID,
  84
  85 int CmdLFNedapDemod(const char *Cmd) {
  86         //raw ask demod no start bit finding just get binary from wave
  87         if (!ASKbiphaseDemod("0 64 0 0", FALSE)) {
  88                 if (g_debugMode) PrintAndLog("DEBUG: Error - Nedap ASKbiphaseDemod failed");
  89                 return 0;
  90         }
  91         size_t size = DemodBufferLen;
  92         int idx = NedapDemod(DemodBuffer, &size);
  93         if (idx < 0){
  94                 if (g_debugMode){
  95                         // if (idx == -5)
  96                                 // PrintAndLog("DEBUG: Error - not enough samples");
  97                         // else if (idx == -1)
  98                                 // PrintAndLog("DEBUG: Error - only noise found");
  99                         // else if (idx == -2)
 100                                 // PrintAndLog("DEBUG: Error - problem during ASK/Biphase demod");
 101                         if (idx == -3)
 102                                 PrintAndLog("DEBUG: Error - Nedap Size not correct: %d", size);
 103                         else if (idx == -4)
 104                                 PrintAndLog("DEBUG: Error - Nedap preamble not found");
 105                         else
 106                                 PrintAndLog("DEBUG: Error - Nedap idx: %d",idx);
 107                 }
 108                 return 0;
 109         }
 110
 111 /* Index map                                                      E                                                                              E
 112  preamble    enc tag type         encrypted uid                   P d    33    d    90    d    04    d    71    d    40    d    45    d    E7    P
 113  1111111110 00101101000001011010001100100100001011010100110101100 1 0 00110011 0 10010000 0 00000100 0 01110001 0 01000000 0 01000101 0 11100111 1
 114                                                                          uid2       uid1       uid0         I          I          R           R
 115  1111111110 00101101000001011010001100100100001011010100110101100 1
 116
 117  0 00110011
 118  0 10010000
 119  0 00000100
 120  0 01110001
 121  0 01000000
 122  0 01000101
 123  0 11100111
 124  1
 125
 126          Tag ID is 049033
 127          I = Identical on all tags
 128          R = Random ?
 129          UID2, UID1, UID0 == card number
 130
 131 */
 132         //get raw ID before removing parities
 133         uint32_t raw[4] = {0,0,0,0};
 134         raw[0] = bytebits_to_byte(DemodBuffer+idx+96,32);
 135         raw[1] = bytebits_to_byte(DemodBuffer+idx+64,32);
 136         raw[2] = bytebits_to_byte(DemodBuffer+idx+32,32);
 137         raw[3] = bytebits_to_byte(DemodBuffer+idx,32);
 138         setDemodBuf(DemodBuffer,128,idx);
 139         setGrid_Clock(64);
 140
 141         uint8_t firstParity = GetParity( DemodBuffer, EVEN, 63);
 142         if ( firstParity != DemodBuffer[63]  ) {
 143                 PrintAndLog("DEBUG: Error - Nedap 1st 64bit parity check failed:  %d|%d ", DemodBuffer[63], firstParity);
 144                 return 0;
 145         }
 146
 147         uint8_t secondParity = GetParity( DemodBuffer+64, EVEN, 63);
 148         if ( secondParity != DemodBuffer[127]  ) {
 149                 PrintAndLog("DEBUG: Error - Nedap 2st 64bit parity check failed:  %d|%d ", DemodBuffer[127], secondParity);
 150                 return 0;
 151         }
 152
 153         // ok valid card found!
 154         uint32_t uid = 0;
 155         uid =  bytebits_to_byte(DemodBuffer+65, 8);
 156         uid |= bytebits_to_byte(DemodBuffer+74, 8) << 8;
 157         uid |= bytebits_to_byte(DemodBuffer+83, 8) << 16;
 158
 159         uint16_t two = 0;
 160         two =  bytebits_to_byte(DemodBuffer+92, 8);
 161         two |= bytebits_to_byte(DemodBuffer+101, 8) << 8;
 162
 163         uint16_t chksum2 = 0;
 164         chksum2 =  bytebits_to_byte(DemodBuffer+110, 8);
 165         chksum2 |= bytebits_to_byte(DemodBuffer+119, 8) << 8;
 166
 167         PrintAndLog("NEDAP ID Found - Raw: %08x%08x%08x%08x", raw[3], raw[2], raw[1], raw[0]);
 168         PrintAndLog(" - UID: %06X", uid);
 169         PrintAndLog(" - i: %04X", two);
 170         PrintAndLog(" - Checksum2 %04X", chksum2);
 171
 172         if (g_debugMode){
 173                 PrintAndLog("DEBUG: idx: %d, Len: %d, Printing Demod Buffer:", idx, 128);
 174                 printDemodBuff();
 175                 PrintAndLog("BIN:\n%s", sprint_bin_break( DemodBuffer, 128, 64) );
 176         }
 177
 178         return 1;
 179 }
 180 /*
 181 configuration
 182 lf t55xx wr b 0 d 00170082
 183
 184 1) uid 049033
 185 lf t55 wr b 1 d FF8B4168
 186 lf t55 wr b 2 d C90B5359
 187 lf t55 wr b 3 d 19A40087
 188 lf t55 wr b 4 d 120115CF
 189
 190 2) uid 001630
 191 lf t55 wr b 1 d FF8B6B20
 192 lf t55 wr b 2 d F19B84A3
 193 lf t55 wr b 3 d 18058007
 194 lf t55 wr b 4 d 1200857C
 195
 196 3) uid 39feff
 197 lf t55xx wr b 1 d ffbfa73e
 198 lf t55xx wr b 2 d 4c0003ff
 199 lf t55xx wr b 3 d ffbfa73e
 200 lf t55xx wr b 4 d 4c0003ff
 201
 202 */
 203
 204 int CmdLFNedapRead(const char *Cmd) {
 205         CmdLFRead("s");
 206         getSamples("12000", TRUE);
 207         return CmdLFNedapDemod("");
 208 }
 209 /*
 210 int CmdLFNedapClone(const char *Cmd) {
 211
 212         char cmdp = param_getchar(Cmd, 0);
 213         if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_nedap_clone();
 214
 215         uint32_t cardnumber=0, cn = 0;
 216         uint32_t blocks[5];
 217         uint8_t i;
 218         uint8_t bs[128];
 219         memset(bs, 0x00, sizeof(bs));
 220
 221         if (sscanf(Cmd, "%u", &cn ) != 1) return usage_lf_nedap_clone();
 222
 223         cardnumber = (cn & 0x00FFFFFF);
 224
 225         if ( !GetNedapBits(cardnumber, bs)) {
 226                 PrintAndLog("Error with tag bitstream generation.");
 227                 return 1;
 228         }
 229
 230         ((ASK/DIphase   data rawdemod ab 0 64 1 0
 231         //NEDAP - compat mode, ASK/DIphase, data rate 64, 4 data blocks
 232         // DI-pahse (CDP) T55x7_MODULATION_DIPHASE
 233         blocks[0] = T55x7_MODULATION_DIPHASE | T55x7_BITRATE_RF_64 | 7 << T55x7_MAXBLOCK_SHIFT;
 234
 235         if (param_getchar(Cmd, 3) == 'Q' || param_getchar(Cmd, 3) == 'q')
 236                 //t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
 237                 blocks[0] = T5555_MODULATION_BIPHASE | T5555_INVERT_OUTPUT | ((64-2)>>1) << T5555_BITRATE_SHIFT | 7 <<T5555_MAXBLOCK_SHIFT;
 238
 239         blocks[1] = bytebits_to_byte(bs,32);
 240         blocks[2] = bytebits_to_byte(bs+32,32);
 241         blocks[3] = bytebits_to_byte(bs+64,32);
 242         blocks[4] = bytebits_to_byte(bs+96,32);
 243
 244         PrintAndLog("Preparing to clone NEDAP to T55x7 with card number: %u", cardnumber);
 245         PrintAndLog("Blk | Data ");
 246         PrintAndLog("----+------------");
 247         for ( i = 0; i<5; ++i )
 248                 PrintAndLog(" %02d | %08" PRIx32, i, blocks[i]);
 249
 250         UsbCommand resp;
 251         UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}};
 252
 253         for ( i = 0; i<5; ++i ) {
 254                 c.arg[0] = blocks[i];
 255                 c.arg[1] = i;
 256                 clearCommandBuffer();
 257                 SendCommand(&c);
 258                 if (!WaitForResponseTimeout(CMD_ACK, &resp, T55XX_WRITE_TIMEOUT)){
 259                         PrintAndLog("Error occurred, device did not respond during write operation.");
 260                         return -1;
 261                 }
 262         }
 263     return 0;
 264 }
 265 */
 266
 267 int CmdLFNedapSim(const char *Cmd) {
 268
 269         char cmdp = param_getchar(Cmd, 0);
 270         if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_nedap_sim();
 271
 272         uint32_t cardnumber = 0, cn = 0;
 273
 274         uint8_t bs[128];
 275         size_t size = sizeof(bs);
 276         memset(bs, 0x00, size);
 277
 278         // NEDAP,  Biphase = 2, clock 64, inverted,  (DIPhase == inverted BIphase
 279         uint8_t encoding = 2, separator = 0, clk=64, invert=1;
 280         uint16_t arg1, arg2;
 281         arg1 = clk << 8 | encoding;
 282         arg2 = invert << 8 | separator;
 283
 284         if (sscanf(Cmd, "%u", &cn ) != 1) return usage_lf_nedap_sim();
 285         cardnumber = (cn & 0x00FFFFFF);
 286
 287         if ( !GetNedapBits(cardnumber, bs)) {
 288                 PrintAndLog("Error with tag bitstream generation.");
 289                 return 1;
 290         }
 291
 292         PrintAndLog("Simulating Nedap - CardNumber: %u", cardnumber );
 293
 294         UsbCommand c = {CMD_ASK_SIM_TAG, {arg1, arg2, size}};
 295         memcpy(c.d.asBytes, bs, size);
 296         clearCommandBuffer();
 297         SendCommand(&c);
 298         return 0;
 299 }
 300
 301 int CmdLFNedapChk(const char *Cmd){
 302     //301600714021BE
 303         uint8_t data[256] = { 0x30, 0x16, 0x00, 0x71, 0x40, 0x21, 0xBE};
 304         int len = 0;
 305         param_gethex_ex(Cmd, 0, data, &len);
 306
 307         len = ( len == 0 ) ? 5 : len>>1;
 308
 309         PrintAndLog("Input: [%d] %s", len, sprint_hex(data, len));
 310
 311         //uint8_t last = GetParity(data, EVEN, 62);
 312         //PrintAndLog("TEST PARITY::  %d | %d ", DemodBuffer[62], last);
 313
 314     uint8_t cl = 0x1D, ch = 0x1D, carry = 0;
 315     uint8_t al, bl, temp;
 316
 317         for (int i =len; i >= 0; --i){
 318                 al = data[i];
 319         for (int j = 8; j > 0; --j) {
 320
 321             bl = al ^ ch;
 322                         //printf("BL %02x | CH %02x \n", al, ch);
 323
 324             carry = (cl & 0x80) ? 1 : 0;
 325             cl <<= 1;
 326
 327             temp = (ch & 0x80) ? 1 : 0;
 328             ch = (ch << 1) | carry;
 329             carry = temp;
 330
 331             carry = (al & 0x80) ? 1 : 0;
 332             al <<= 1;
 333
 334             carry = (bl & 0x80) ? 1 : 0;
 335             bl <<= 1;
 336
 337             if (carry) {
 338                 cl ^= 0x21;
 339                 ch ^= 0x10;
 340             }
 341         }
 342     }
 343
 344         PrintAndLog("Nedap checksum: 0x%X", ((ch << 8) | cl) );
 345         return 0;
 346 }
 347
 348
 349 static command_t CommandTable[] = {
 350     {"help",    CmdHelp,                1, "This help"},
 351         {"read",        CmdLFNedapRead, 0, "Attempt to read and extract tag data"},
 352 //      {"clone",       CmdLFNedapClone,0, "<Card Number>  clone nedap tag"},
 353         {"sim",         CmdLFNedapSim,  0, "<Card Number>  simulate nedap tag"},
 354         {"chk",         CmdLFNedapChk,  1, "Calculate Nedap Checksum <uid bytes>"},
 355     {NULL, NULL, 0, NULL}
 356 };
 357
 358 int CmdLFNedap(const char *Cmd) {
 359         clearCommandBuffer();
 360     CmdsParse(CommandTable, Cmd);
 361     return 0;
 362 }
 363
 364 int CmdHelp(const char *Cmd) {
 365     CmdsHelp(CommandTable);
 366     return 0;
 367 }