]>
Commit | Line | Data |
---|---|---|
50564be0 | 1 | //----------------------------------------------------------------------------- |
2 | // | |
3 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, | |
4 | // at your option, any later version. See the LICENSE.txt file for the text of | |
5 | // the license. | |
6 | //----------------------------------------------------------------------------- | |
7 | // Low frequency Farpoint / Pyramid tag commands | |
8 | //----------------------------------------------------------------------------- | |
9 | #include <string.h> | |
10 | #include <inttypes.h> | |
11 | #include "cmdlfguard.h" | |
12 | static int CmdHelp(const char *Cmd); | |
13 | ||
14 | int usage_lf_guard_clone(void){ | |
15 | PrintAndLog("clone a Guardall tag to a T55x7 tag."); | |
16 | PrintAndLog("The facility-code is 8-bit and the card number is 16-bit. Larger values are truncated. "); | |
17 | PrintAndLog("Currently work only on 26bit"); | |
18 | PrintAndLog(""); | |
19 | PrintAndLog("Usage: lf guard clone <Facility-Code> <Card-Number>"); | |
20 | PrintAndLog("Options :"); | |
21 | PrintAndLog(" <Facility-Code> : 8-bit value facility code"); | |
22 | PrintAndLog(" <Card Number> : 16-bit value card number"); | |
23 | PrintAndLog(""); | |
24 | PrintAndLog("Sample : lf guard clone 123 11223"); | |
25 | return 0; | |
26 | } | |
27 | ||
28 | int usage_lf_guard_sim(void) { | |
29 | PrintAndLog("Enables simulation of Guardall card with specified card number."); | |
30 | PrintAndLog("Simulation runs until the button is pressed or another USB command is issued."); | |
31 | PrintAndLog("The facility-code is 8-bit and the card number is 16-bit. Larger values are truncated."); | |
32 | PrintAndLog("Currently work only on 26bit"); | |
33 | PrintAndLog(""); | |
34 | PrintAndLog("Usage: lf guard sim <Card-Number>"); | |
35 | PrintAndLog("Options :"); | |
36 | PrintAndLog(" <Facility-Code> : 8-bit value facility code"); | |
37 | PrintAndLog(" <Card Number> : 16-bit value card number"); | |
38 | PrintAndLog(""); | |
39 | PrintAndLog("Sample : lf guard sim 123 11223"); | |
40 | return 0; | |
41 | } | |
42 | ||
43 | ||
44 | // Works for 26bits. | |
45 | int GetGuardBits(uint32_t fc, uint32_t cn, uint8_t *guardBits) { | |
46 | ||
47 | // Intializes random number generator | |
48 | time_t t; | |
49 | srand((unsigned) time(&t)); | |
0d2c5909 | 50 | //uint8_t xorKey = rand() % 0xFF; |
51 | uint8_t xorKey = 0x6b; | |
52 | uint8_t i; | |
50564be0 | 53 | |
50564be0 | 54 | |
0d2c5909 | 55 | uint8_t pre[96]; |
56 | memset(pre, 0x00, sizeof(pre)); | |
50564be0 | 57 | |
50564be0 | 58 | // Get 26 wiegand from FacilityCode, CardNumber |
59 | uint8_t wiegand[24]; | |
60 | memset(wiegand, 0x00, sizeof(wiegand)); | |
61 | num_to_bytebits(fc, 8, wiegand); | |
62 | num_to_bytebits(cn, 16, wiegand+8); | |
63 | ||
64 | // add wiegand parity bits (dest, source, len) | |
0d2c5909 | 65 | wiegand_add_parity(pre, wiegand, 24); |
50564be0 | 66 | |
0d2c5909 | 67 | // lets start. 12bytes of data to be produced. |
68 | uint8_t rawbytes[12]; | |
69 | memset(rawbytes, 0x00, sizeof(rawbytes)); | |
70 | ||
71 | // xor key | |
72 | rawbytes[0] = xorKey; | |
73 | ||
74 | // add format length (decimal) | |
75 | // len | hex | bin | |
76 | // 26 | 1A | 0001 1010 | |
77 | rawbytes[1] = (26 << 2); | |
78 | // 36 | 24 | 0010 0100 | |
79 | //rawbytes[1] = (36 << 2); | |
80 | // 40 | 28 | 0010 1000 | |
81 | //rawbytes[1] = (40 << 2); | |
82 | ||
83 | // 2bit checksum, unknown today, | |
84 | // these two bits are the last ones of rawbyte[1], hence the LSHIFT above. | |
85 | rawbytes[2] = 1; | |
86 | rawbytes[3] = 0; | |
50564be0 | 87 | |
0d2c5909 | 88 | // add wiegand to rawbytes |
89 | for (i = 0; i < 4; ++i) | |
90 | rawbytes[i+4] = bytebits_to_byte( pre + (i*8), 8); | |
50564be0 | 91 | |
0d2c5909 | 92 | if (g_debugMode) printf(" WIE | %s\n", sprint_hex(rawbytes, sizeof(rawbytes))); |
50564be0 | 93 | |
0d2c5909 | 94 | // NIBBLE_SWAP (works on all data) |
95 | // for (i = 0; i < 12; ++i) | |
96 | // rawbytes[i] = SWAP_NIBBLE( rawbytes[i] ); | |
97 | ||
98 | // printf("SWAP | %s\n", sprint_hex(rawbytes, sizeof(rawbytes))); | |
50564be0 | 99 | |
0d2c5909 | 100 | // XOR (only works on wiegand stuff) |
101 | for (i = 1; i < 12; ++i) | |
102 | rawbytes[i] ^= xorKey ; | |
103 | ||
104 | if (g_debugMode) printf(" XOR | %s \n", sprint_hex(rawbytes, sizeof(rawbytes))); | |
105 | ||
106 | // convert rawbytes to bits in pre | |
107 | for (i = 0; i < 12; ++i) | |
108 | num_to_bytebitsLSBF( rawbytes[i], 8, pre + (i*8)); | |
109 | ||
110 | if (g_debugMode) printf("\n Raw | %s \n", sprint_hex(rawbytes, sizeof(rawbytes))); | |
111 | if (g_debugMode) printf(" Raw | %s\n", sprint_bin(pre, 64) ); | |
112 | ||
113 | // add spacer bit 0 every 4 bits, starting with index 0, | |
114 | // 12 bytes, 24 nibbles. 24+1 extra bites. 3bytes. Ie 9bytes | 1byte xorkey, 8bytes rawdata (64bits, should be enough for a 40bit wiegand) | |
115 | addParity(pre, guardBits+6, 64, 5, 3); | |
116 | ||
117 | // preamble | |
118 | guardBits[0] = 1; | |
119 | guardBits[1] = 1; | |
120 | guardBits[2] = 1; | |
121 | guardBits[3] = 1; | |
122 | guardBits[4] = 1; | |
123 | guardBits[5] = 0; | |
124 | /* 6 B | |
125 | PRE | 0110 1101 0101 1110 0001 1101 1101 0111 1101011011010110110101101101011 | |
126 | FIN | 111110 0 0110 0 1101 0 0101 0 1110 0 0001 0 1101 0 1101 0 0111 0 110100110011010011001101001100110100110000000000 | |
127 | */ | |
128 | ||
129 | if (g_debugMode) printf(" FIN | %s\n", sprint_bin(guardBits, 96) ); | |
50564be0 | 130 | return 1; |
131 | } | |
132 | ||
133 | int CmdGuardRead(const char *Cmd) { | |
134 | CmdLFRead("s"); | |
135 | getSamples("30000",false); | |
136 | return CmdG_Prox_II_Demod(""); | |
137 | } | |
138 | ||
139 | int CmdGuardClone(const char *Cmd) { | |
140 | ||
141 | char cmdp = param_getchar(Cmd, 0); | |
142 | if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_guard_clone(); | |
143 | ||
144 | uint32_t facilitycode=0, cardnumber=0, fc = 0, cn = 0; | |
145 | uint8_t i; | |
146 | uint8_t bs[96]; | |
147 | memset(bs, 0x00, sizeof(bs)); | |
148 | ||
149 | //GuardProxII - compat mode, ASK/Biphase, data rate 64, 3 data blocks | |
150 | uint32_t blocks[5] = {T55x7_MODULATION_BIPHASE | T55x7_BITRATE_RF_64 | 3<<T55x7_MAXBLOCK_SHIFT, 0, 0, 0, 0}; | |
151 | ||
152 | // if (param_getchar(Cmd, 3) == 'Q' || param_getchar(Cmd, 3) == 'q') | |
153 | // blocks[0] = T5555_MODULATION_FSK2 | 50<<T5555_BITRATE_SHIFT | 4<<T5555_MAXBLOCK_SHIFT; | |
154 | ||
155 | if (sscanf(Cmd, "%u %u", &fc, &cn ) != 2) return usage_lf_guard_clone(); | |
156 | ||
157 | facilitycode = (fc & 0x000000FF); | |
158 | cardnumber = (cn & 0x0000FFFF); | |
159 | ||
160 | if ( !GetGuardBits(facilitycode, cardnumber, bs)) { | |
161 | PrintAndLog("Error with tag bitstream generation."); | |
162 | return 1; | |
163 | } | |
164 | ||
165 | blocks[1] = bytebits_to_byte(bs,32); | |
166 | blocks[2] = bytebits_to_byte(bs+32,32); | |
167 | blocks[3] = bytebits_to_byte(bs+64,32); | |
168 | ||
169 | PrintAndLog("Preparing to clone Guardall to T55x7 with Facility Code: %u, Card Number: %u", facilitycode, cardnumber); | |
170 | PrintAndLog("Blk | Data "); | |
171 | PrintAndLog("----+------------"); | |
172 | for ( i = 0; i<4; ++i ) | |
173 | PrintAndLog(" %02d | %08x", i, blocks[i]); | |
174 | ||
0d2c5909 | 175 | UsbCommand resp; |
176 | UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}}; | |
177 | ||
178 | for ( i = 0; i<4; ++i ) { | |
179 | c.arg[0] = blocks[i]; | |
180 | c.arg[1] = i; | |
181 | clearCommandBuffer(); | |
182 | SendCommand(&c); | |
183 | if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){ | |
184 | PrintAndLog("Error occurred, device did not respond during write operation."); | |
185 | return -1; | |
186 | } | |
187 | } | |
50564be0 | 188 | return 0; |
189 | } | |
190 | ||
191 | int CmdGuardSim(const char *Cmd) { | |
192 | ||
193 | char cmdp = param_getchar(Cmd, 0); | |
194 | if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_guard_sim(); | |
195 | ||
196 | uint32_t facilitycode = 0, cardnumber = 0, fc = 0, cn = 0; | |
197 | ||
198 | uint8_t bs[96]; | |
199 | size_t size = sizeof(bs); | |
200 | memset(bs, 0x00, size); | |
201 | ||
202 | // Pyramid uses: ASK Biphase, clk: 32, invert: 0 | |
203 | uint64_t arg1, arg2; | |
204 | arg1 = (10 << 8) + 8; | |
205 | arg2 = 32 | 0; | |
206 | ||
207 | if (sscanf(Cmd, "%u %u", &fc, &cn ) != 2) return usage_lf_guard_sim(); | |
208 | ||
209 | facilitycode = (fc & 0x000000FF); | |
210 | cardnumber = (cn & 0x0000FFFF); | |
211 | ||
212 | if ( !GetGuardBits(facilitycode, cardnumber, bs)) { | |
213 | PrintAndLog("Error with tag bitstream generation."); | |
214 | return 1; | |
215 | } | |
216 | ||
217 | PrintAndLog("Simulating Guardall - Facility Code: %u, CardNumber: %u", facilitycode, cardnumber ); | |
218 | ||
219 | UsbCommand c = {CMD_ASK_SIM_TAG, {arg1, arg2, size}}; | |
220 | memcpy(c.d.asBytes, bs, size); | |
221 | clearCommandBuffer(); | |
222 | SendCommand(&c); | |
223 | return 0; | |
224 | } | |
225 | ||
226 | static command_t CommandTable[] = { | |
227 | {"help", CmdHelp, 1, "This help"}, | |
228 | {"read", CmdGuardRead, 0, "Attempt to read and extract tag data"}, | |
0d2c5909 | 229 | {"clone", CmdGuardClone, 0, "<Facility-Code> <Card Number> clone Guardall tag"}, |
2453ca65 | 230 | // {"sim", CmdGuardSim, 0, "<Facility-Code> <Card Number> simulate Guardall tag"}, |
50564be0 | 231 | {NULL, NULL, 0, NULL} |
232 | }; | |
233 | ||
234 | int CmdLFGuard(const char *Cmd) { | |
235 | clearCommandBuffer(); | |
236 | CmdsParse(CommandTable, Cmd); | |
237 | return 0; | |
238 | } | |
239 | ||
240 | int CmdHelp(const char *Cmd) { | |
241 | CmdsHelp(CommandTable); | |
242 | return 0; | |
243 | } |