]> git.zerfleddert.de Git - proxmark3-svn/blame - client/cmdlfawid.c
Merge pull request #13 from k02a/patch-1
[proxmark3-svn] / client / cmdlfawid.c
CommitLineData
db25599d 1//-----------------------------------------------------------------------------
2// Authored by Craig Young <cyoung@tripwire.com> based on cmdlfhid.c structure
3//
4// cmdlfhid.c is Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
5//
6// This code is licensed to you under the terms of the GNU GPL, version 2 or,
7// at your option, any later version. See the LICENSE.txt file for the text of
8// the license.
9//-----------------------------------------------------------------------------
10// Low frequency AWID26 commands
11//-----------------------------------------------------------------------------
12
13#include <stdio.h> // sscanf
14#include "proxmark3.h" // Definitions, USB controls, etc
15#include "ui.h" // PrintAndLog
16#include "cmdparser.h" // CmdsParse, CmdsHelp
17#include "cmdlfawid.h" // AWID function declarations
18#include "lfdemod.h" // parityTest
a126332a 19#include "util.h" // weigandparity
20#include "protocols.h" // for T55xx config register definitions
7838f4be 21#include "cmdmain.h"
978920b9 22#include "sleep.h"
508b37ba 23
db25599d 24static int CmdHelp(const char *Cmd);
25
db25599d 26int usage_lf_awid_fskdemod(void) {
8fd9bfb0 27 PrintAndLog("Enables AWID compatible reader mode printing details of scanned AWID26 or AWID50 tags.");
a126332a 28 PrintAndLog("By default, values are printed and logged until the button is pressed or another USB command is issued.");
8fd9bfb0 29 PrintAndLog("If the [1] option is provided, reader mode is exited after reading a single AWID card.");
a126332a 30 PrintAndLog("");
890ae3dd 31 PrintAndLog("Usage: lf awid fskdemod [h] [1]");
a126332a 32 PrintAndLog("Options :");
890ae3dd 33 PrintAndLog(" h : This help");
8fd9bfb0 34 PrintAndLog(" 1 : (optional) stop after reading a single card");
a126332a 35 PrintAndLog("");
8fd9bfb0 36 PrintAndLog("Samples");
37 PrintAndLog(" lf awid fskdemod");
38 PrintAndLog(" lf awid fskdemod 1");
a126332a 39 return 0;
db25599d 40}
41
42int usage_lf_awid_sim(void) {
8fd9bfb0 43 PrintAndLog("Enables simulation of AWID card with specified facility-code and card number.");
a126332a 44 PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
a126332a 45 PrintAndLog("");
890ae3dd 46 PrintAndLog("Usage: lf awid sim [h] <format> <facility-code> <card-number>");
a126332a 47 PrintAndLog("Options :");
890ae3dd 48 PrintAndLog(" h : This help");
49 PrintAndLog(" <format> : format length 26|50");
8fd9bfb0 50 PrintAndLog(" <facility-code> : 8|16bit value facility code");
890ae3dd 51 PrintAndLog(" <card number> : 16|32-bit value card number");
a126332a 52 PrintAndLog("");
8fd9bfb0 53 PrintAndLog("Samples");
54 PrintAndLog(" lf awid sim 26 224 1337");
55 PrintAndLog(" lf awid sim 50 2001 13371337");
a126332a 56 return 0;
db25599d 57}
58
59int usage_lf_awid_clone(void) {
8fd9bfb0 60 PrintAndLog("Enables cloning of AWID card with specified facility-code and card number onto T55x7.");
a126332a 61 PrintAndLog("The T55x7 must be on the antenna when issuing this command. T55x7 blocks are calculated and printed in the process.");
a126332a 62 PrintAndLog("");
890ae3dd 63 PrintAndLog("Usage: lf awid clone [h] <format> <facility-code> <card-number> [Q5]");
a126332a 64 PrintAndLog("Options :");
890ae3dd 65 PrintAndLog(" h : This help");
66 PrintAndLog(" <format> : format length 26|50");
8fd9bfb0 67 PrintAndLog(" <facility-code> : 8|16bit value facility code");
890ae3dd 68 PrintAndLog(" <card number> : 16|32-bit value card number");
69 PrintAndLog(" Q5 : optional - clone to Q5 (T5555) instead of T55x7 chip");
a126332a 70 PrintAndLog("");
8fd9bfb0 71 PrintAndLog("Samples");
72 PrintAndLog(" lf awid clone 26 224 1337");
73 PrintAndLog(" lf awid clone 50 2001 13371337");
a126332a 74 return 0;
db25599d 75}
76
508b37ba 77int usage_lf_awid_brute(void){
8fd9bfb0 78 PrintAndLog("Enables bruteforce of AWID reader with specified facility-code.");
978920b9 79 PrintAndLog("This is a incremental attack against reader.");
508b37ba 80 PrintAndLog("");
890ae3dd 81 PrintAndLog("Usage: lf awid brute [h] <format> <facility-code>");
508b37ba 82 PrintAndLog("Options :");
890ae3dd 83 PrintAndLog(" h : This help");
84 PrintAndLog(" <format> : format length 26|50");
8fd9bfb0 85 PrintAndLog(" <facility-code> : 8|16bit value facility code");
508b37ba 86 PrintAndLog("");
8fd9bfb0 87 PrintAndLog("Samples");
88 PrintAndLog(" lf awid brute 26 224");
89 PrintAndLog(" lf awid brute 50 2001");
508b37ba 90 return 0;
91}
92
52f2df61 93int CmdAWIDDemodFSK(const char *Cmd) {
a126332a 94 int findone = 0;
95 if (Cmd[0] == 'h' || Cmd[0] == 'H') return usage_lf_awid_fskdemod();
96 if (Cmd[0] == '1') findone = 1;
97
98 UsbCommand c = {CMD_AWID_DEMOD_FSK, {findone, 0, 0}};
99 clearCommandBuffer();
100 SendCommand(&c);
101 return 0;
db25599d 102}
103
a126332a 104//refactored by marshmellow
8fd9bfb0 105int getAWIDBits(uint8_t fmtlen, uint32_t fc, uint32_t cn, uint8_t *bits) {
106
107 // the return bits, preamble 0000 0001
108 bits[7] = 1;
109
a126332a 110 uint8_t pre[66];
111 memset(pre, 0, sizeof(pre));
52f2df61 112
8fd9bfb0 113 // add formatlength
114 num_to_bytebits(fmtlen, 8, pre);
115
116 // add facilitycode, cardnumber and wiegand parity bits
117 if ( fmtlen == 26 ) {
118 uint8_t wiegand[24];
119 num_to_bytebits(fc, 8, wiegand);
120 num_to_bytebits(cn, 16, wiegand+8);
121 wiegand_add_parity(pre+8, wiegand, sizeof(wiegand));
122 } else {
123 uint8_t wiegand[48];
124 num_to_bytebits(fc, 16, wiegand);
125 num_to_bytebits(cn, 32, wiegand+16);
126 wiegand_add_parity(pre+8, wiegand, sizeof(wiegand));
127 }
128
129 // add AWID 4bit parity
130 size_t bitLen = addParity(pre, bits+8, 66, 4, 1);
fcb1cdba 131
a126332a 132 if (bitLen != 88) return 0;
52f2df61 133 return 1;
db25599d 134}
135
a126332a 136int CmdAWIDSim(const char *Cmd) {
8fd9bfb0 137 uint32_t fc = 0, cn = 0;
138 uint8_t fmtlen = 0;
a126332a 139 uint8_t bits[96];
140 uint8_t *bs = bits;
141 size_t size = sizeof(bits);
fcb1cdba 142 memset(bs, 0x00, size);
52f2df61 143
fcb1cdba 144 uint64_t arg1 = ( 10 << 8 ) + 8; // fcHigh = 10, fcLow = 8
52f2df61 145 uint64_t arg2 = 50; // clk RF/50 invert=0
146
8fd9bfb0 147 char cmdp = param_getchar(Cmd, 0);
148 if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_awid_sim();
52f2df61 149
8fd9bfb0 150 fmtlen = param_get8(Cmd, 0);
151 fc = param_get32ex(Cmd, 1, 0, 10);
152 cn = param_get32ex(Cmd, 2, 0, 10);
153 if ( !fc || !cn) return usage_lf_awid_sim();
52f2df61 154
8fd9bfb0 155 switch(fmtlen) {
156 case 26:
157 if ((fc & 0xFF) != fc) {
158 fc &= 0xFF;
159 PrintAndLog("Facility-Code Truncated to 8-bits (AWID26): %u", fc);
160 }
161
162 if ((cn & 0xFFFF) != cn) {
163 cn &= 0xFFFF;
164 PrintAndLog("Card Number Truncated to 16-bits (AWID26): %u", cn);
165 }
166 break;
167 case 50:
168 if ((fc & 0xFFFF) != fc) {
169 fc &= 0xFFFF;
170 PrintAndLog("Facility-Code Truncated to 16-bits (AWID50): %u", fc);
171 }
172 break;
173 default: break;
174 }
175
176 PrintAndLog("Emulating AWID %u -- FC: %u; CN: %u\n", fmtlen, fc, cn);
52f2df61 177 PrintAndLog("Press pm3-button to abort simulation or run another command");
178
8fd9bfb0 179 if (!getAWIDBits(fmtlen, fc, cn, bs)) {
52f2df61 180 PrintAndLog("Error with tag bitstream generation.");
181 return 1;
182 }
183 // AWID uses: fcHigh: 10, fcLow: 8, clk: 50, invert: 0
52f2df61 184 // arg1 --- fcHigh<<8 + fcLow
185 // arg2 --- Inversion and clk setting
186 // 96 --- Bitstream length: 96-bits == 12 bytes
a126332a 187 UsbCommand c = {CMD_FSK_SIM_TAG, {arg1, arg2, size}};
188 memcpy(c.d.asBytes, bs, size);
52f2df61 189 clearCommandBuffer();
190 SendCommand(&c);
191 return 0;
db25599d 192}
193
a126332a 194int CmdAWIDClone(const char *Cmd) {
195 uint32_t blocks[4] = {T55x7_MODULATION_FSK2a | T55x7_BITRATE_RF_50 | 3<<T55x7_MAXBLOCK_SHIFT, 0, 0, 0};
8fd9bfb0 196 uint32_t fc = 0, cn = 0;
197 uint8_t fmtlen = 0;
a126332a 198 uint8_t bits[96];
52f2df61 199 uint8_t *bs=bits;
a126332a 200 memset(bs,0,sizeof(bits));
52f2df61 201
8fd9bfb0 202 char cmdp = param_getchar(Cmd, 0);
203 if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_awid_clone();
f3cfe428 204
8fd9bfb0 205 fmtlen = param_get8(Cmd, 0);
206 fc = param_get32ex(Cmd, 1, 0, 10);
207 cn = param_get32ex(Cmd, 2, 0, 10);
a126332a 208
8fd9bfb0 209 if ( !fc || !cn) return usage_lf_awid_clone();
210
211 switch(fmtlen) {
212 case 50:
213 if ((fc & 0xFFFF) != fc) {
214 fc &= 0xFFFF;
215 PrintAndLog("Facility-Code Truncated to 16-bits (AWID50): %u", fc);
216 }
217 break;
218 default:
219 fmtlen = 26;
220 if ((fc & 0xFF) != fc) {
221 fc &= 0xFF;
222 PrintAndLog("Facility-Code Truncated to 8-bits (AWID26): %u", fc);
223 }
f3cfe428 224
8fd9bfb0 225 if ((cn & 0xFFFF) != cn) {
226 cn &= 0xFFFF;
227 PrintAndLog("Card Number Truncated to 16-bits (AWID26): %u", cn);
228 }
229 break;
f3cfe428 230 }
52f2df61 231
8fd9bfb0 232 if (param_getchar(Cmd, 4) == 'Q' || param_getchar(Cmd, 4) == 'q')
890ae3dd 233 //t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
8fd9bfb0 234 blocks[0] = T5555_MODULATION_FSK2 | T5555_INVERT_OUTPUT | 50<<T5555_BITRATE_SHIFT | 3<<T5555_MAXBLOCK_SHIFT;
235
236 if ( !getAWIDBits(fmtlen, fc, cn, bs)) {
52f2df61 237 PrintAndLog("Error with tag bitstream generation.");
238 return 1;
239 }
240
a126332a 241 blocks[1] = bytebits_to_byte(bs,32);
242 blocks[2] = bytebits_to_byte(bs+32,32);
243 blocks[3] = bytebits_to_byte(bs+64,32);
52f2df61 244
8fd9bfb0 245 PrintAndLog("Preparing to clone AWID %u to T55x7 with FC: %u, CN: %u", fmtlen, fc, cn);
52f2df61 246 PrintAndLog("Blk | Data ");
247 PrintAndLog("----+------------");
248 PrintAndLog(" 00 | 0x%08x", blocks[0]);
249 PrintAndLog(" 01 | 0x%08x", blocks[1]);
250 PrintAndLog(" 02 | 0x%08x", blocks[2]);
251 PrintAndLog(" 03 | 0x%08x", blocks[3]);
252
253 UsbCommand resp;
254 UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}};
f3cfe428 255
a126332a 256 for (uint8_t i=0; i<4; i++) {
52f2df61 257 c.arg[0] = blocks[i];
258 c.arg[1] = i;
259 clearCommandBuffer();
260 SendCommand(&c);
26922aef 261 if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)){
52f2df61 262 PrintAndLog("Error occurred, device did not respond during write operation.");
263 return -1;
f3cfe428 264 }
265 }
266 return 0;
db25599d 267}
268
508b37ba 269int CmdAWIDBrute(const char *Cmd){
270
8fd9bfb0 271 uint32_t fc = 0x00;
272 uint8_t fmtlen = 0;
508b37ba 273 uint8_t bits[96];
274 uint8_t *bs = bits;
275 size_t size = sizeof(bits);
276 memset(bs, 0x00, size);
277
278 char cmdp = param_getchar(Cmd, 0);
8fd9bfb0 279 if (strlen(Cmd) > 4 || strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_awid_brute();
508b37ba 280
8fd9bfb0 281 fmtlen = param_get8(Cmd, 0);
282 fc = param_get32ex(Cmd, 1, 0, 10);
283 if ( !fc ) return usage_lf_awid_brute();
284
285 switch(fmtlen) {
286 case 50:
287 if ((fc & 0xFFFF) != fc) {
288 fc &= 0xFFFF;
289 PrintAndLog("Facility-Code Truncated to 16-bits (AWID50): %u", fc);
290 }
291 break;
292 default:
293 if ((fc & 0xFF) != fc) {
294 fc &= 0xFF;
295 PrintAndLog("Facility-Code Truncated to 8-bits (AWID26): %u", fc);
296 }
297 break;
298 }
508b37ba 299
8fd9bfb0 300 PrintAndLog("Bruteforceing AWID %d Reader", fmtlen);
508b37ba 301 PrintAndLog("Press pm3-button to abort simulation or run another command");
302
303 uint64_t arg1 = (10<<8) + 8; // fcHigh = 10, fcLow = 8
304 uint64_t arg2 = 50; // clk RF/50 invert=0
305 UsbCommand c = {CMD_FSK_SIM_TAG, {arg1, arg2, size}};
306
307 for ( uint16_t cn = 1; cn < 0xFFFF; ++cn){
308 if (ukbhit()) {
309 PrintAndLog("aborted via keyboard!");
310 c.cmd = CMD_PING;
311 c.arg[0] = 0x00;
312 c.arg[1] = 0x00;
313 c.arg[2] = 0x00;
314 clearCommandBuffer();
315 SendCommand(&c);
316 return 1;
317 }
318
8fd9bfb0 319 (void)getAWIDBits(fmtlen, fc, cn, bs);
508b37ba 320 memcpy(c.d.asBytes, bs, size);
321 clearCommandBuffer();
322 SendCommand(&c);
323
324 PrintAndLog("Trying FC: %u; CN: %u", fc, cn);
325 // pause
326 sleep(1);
327 }
328 return 0;
329}
330
a126332a 331static command_t CommandTable[] = {
f3cfe428 332 {"help", CmdHelp, 1, "This help"},
333 {"fskdemod", CmdAWIDDemodFSK, 0, "['1'] Realtime AWID FSK demodulator (option '1' for one tag only)"},
334 {"sim", CmdAWIDSim, 0, "<Facility-Code> <Card Number> -- AWID tag simulator"},
a126332a 335 {"clone", CmdAWIDClone, 0, "<Facility-Code> <Card Number> <Q5> -- Clone AWID to T55x7"},
508b37ba 336 {"brute", CmdAWIDBrute, 0, "<Facility-Code> -- bruteforce card number"},
f3cfe428 337 {NULL, NULL, 0, NULL}
db25599d 338};
339
a126332a 340int CmdLFAWID(const char *Cmd) {
4c36581b 341 clearCommandBuffer();
f3cfe428 342 CmdsParse(CommandTable, Cmd);
343 return 0;
db25599d 344}
345
a126332a 346int CmdHelp(const char *Cmd) {
f3cfe428 347 CmdsHelp(CommandTable);
348 return 0;
db25599d 349}
Impressum, Datenschutz