]> git.zerfleddert.de Git - proxmark3-svn/blame - client/cmdlfnedap.c
Merge pull request #13 from k02a/patch-1
[proxmark3-svn] / client / cmdlfnedap.c
CommitLineData
56bbb25a 1//-----------------------------------------------------------------------------
2//
3// This code is licensed to you under the terms of the GNU GPL, version 2 or,
4// at your option, any later version. See the LICENSE.txt file for the text of
5// the license.
6//-----------------------------------------------------------------------------
7// Low frequency NEDAP tag commands
8//-----------------------------------------------------------------------------
9#include <string.h>
10#include <inttypes.h>
11#include "cmdlfnedap.h"
12static int CmdHelp(const char *Cmd);
13
14int usage_lf_nedap_clone(void){
15 PrintAndLog("clone a NEDAP tag to a T55x7 tag.");
16 PrintAndLog("");
17 PrintAndLog("Usage: lf nedap clone <Card-Number>");
18 PrintAndLog("Options :");
19 PrintAndLog(" <Card Number> : 24-bit value card number");
20// PrintAndLog(" Q5 : optional - clone to Q5 (T5555) instead of T55x7 chip");
21 PrintAndLog("");
22 PrintAndLog("Sample : lf nedap clone 112233");
23 return 0;
24}
25
26int usage_lf_nedap_sim(void) {
27 PrintAndLog("Enables simulation of NEDAP card with specified card number.");
28 PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
29 PrintAndLog("");
30 PrintAndLog("Usage: lf nedap sim <Card-Number>");
31 PrintAndLog("Options :");
32 PrintAndLog(" <Card Number> : 24-bit value card number");
33 PrintAndLog("");
34 PrintAndLog("Sample : lf nedap sim 112233");
35 return 0;
36}
37
38int GetNedapBits(uint32_t cn, uint8_t *nedapBits) {
39
40 uint8_t pre[128];
41 memset(pre, 0x00, sizeof(pre));
42
43 // preamble 1111 1111 10 = 0XF8
44 num_to_bytebits(0xF8, 10, pre);
45
46 // fixed tagtype code? 0010 1101 = 0x2D
47 num_to_bytebits(0x2D, 8, pre+10);
48
49 // 46 encrypted bits - UNKNOWN ALGO
50 // -- 16 bits checksum. Should be 4x4 checksum, based on UID and 2 constant values.
51 // -- 30 bits undocumented?
52 num_to_bytebits(cn, 46, pre+18);
53
54 //----from this part, the UID in clear text, with a 1bit ZERO as separator between bytes.
55 pre[64] = 0;
56
2d1885f1 57 // cardnumber (uid)
56bbb25a 58 num_to_bytebits(cn, 24, pre+64);
59
60 pre[73] = 0;
61 pre[82] = 0;
62 pre[91] = 0;
63 pre[100] = 0;
64 pre[109] = 0;
65 pre[118] = 0;
66
67 // add paritybits (bitsource, dest, sourcelen, paritylen, parityType (odd, even,)
68 addParity(pre+64, pre+64, 128, 8, 1);
c71f4da9 69
56bbb25a 70//1111111110001011010000010110100011001001000010110101001101011001000110011010010000000000100001110001001000000001000101011100111
71 return 1;
72}
2d1885f1 73/*
74 - UID: 001630
75 - i: 4071
76 - Checksum2 BE21
77*/
c71f4da9 78//GetParity( uint8_t *bits, uint8_t type, int length)
79
2d1885f1 80//NEDAP demod - ASK/Biphase (or Diphase), RF/64 with preamble of 1111111110 (always a 128 bit data stream)
56bbb25a 81//print NEDAP Prox ID, encoding, encrypted ID,
c71f4da9 82
83int CmdLFNedapDemod(const char *Cmd) {
56bbb25a 84 //raw ask demod no start bit finding just get binary from wave
85 uint8_t BitStream[MAX_GRAPH_TRACE_LEN]={0};
86 size_t size = getFromGraphBuf(BitStream);
87 if (size==0) return 0;
88
96faed21 89 //get binary from ask wave
c71f4da9 90 if (!ASKbiphaseDemod("0 64 0 0", FALSE)) {
96faed21 91 if (g_debugMode) PrintAndLog("Error NEDAP: ASKbiphaseDemod failed");
92 return 0;
93 }
d34a0b0c 94 size = DemodBufferLen;
c71f4da9 95 int idx = NedapDemod(DemodBuffer, &size);
56bbb25a 96 if (idx < 0){
97 if (g_debugMode){
2d1885f1 98 // if (idx == -5)
99 // PrintAndLog("DEBUG: Error - not enough samples");
100 // else if (idx == -1)
101 // PrintAndLog("DEBUG: Error - only noise found");
102 // else if (idx == -2)
103 // PrintAndLog("DEBUG: Error - problem during ASK/Biphase demod");
104 if (idx == -3)
56bbb25a 105 PrintAndLog("DEBUG: Error - Size not correct: %d", size);
106 else if (idx == -4)
107 PrintAndLog("DEBUG: Error - NEDAP preamble not found");
108 else
109 PrintAndLog("DEBUG: Error - idx: %d",idx);
110 }
111 return 0;
112 }
113
2d1885f1 114/* Index map E E
115 preamble enc tag type encrypted uid P d 33 d 90 d 04 d 71 d 40 d 45 d E7 P
116 1111111110 00101101000001011010001100100100001011010100110101100 1 0 00110011 0 10010000 0 00000100 0 01110001 0 01000000 0 01000101 0 11100111 1
532bcd71 117 uid2 uid1 uid0 I I R R
2d1885f1 118 1111111110 00101101000001011010001100100100001011010100110101100 1
119
120 0 00110011
121 0 10010000
122 0 00000100
123 0 01110001
124 0 01000000
125 0 01000101
126 0 11100111
127 1
128
56bbb25a 129 Tag ID is 049033
130 I = Identical on all tags
131 R = Random ?
132 UID2, UID1, UID0 == card number
532bcd71 133
56bbb25a 134*/
56bbb25a 135 //get raw ID before removing parities
2d1885f1 136 uint32_t raw[4] = {0,0,0,0};
137 raw[0] = bytebits_to_byte(DemodBuffer+idx+96,32);
138 raw[1] = bytebits_to_byte(DemodBuffer+idx+64,32);
139 raw[2] = bytebits_to_byte(DemodBuffer+idx+32,32);
140 raw[3] = bytebits_to_byte(DemodBuffer+idx,32);
c71f4da9 141 setDemodBuf(DemodBuffer,128,idx);
56bbb25a 142
2d1885f1 143 uint8_t firstParity = GetParity( DemodBuffer, EVEN, 63);
144 if ( firstParity != DemodBuffer[63] ) {
145 PrintAndLog("1st 64bit parity check failed: %d|%d ", DemodBuffer[63], firstParity);
146 //return 0;
532bcd71 147 }
148
2d1885f1 149 uint8_t secondParity = GetParity( DemodBuffer+64, EVEN, 63);
150 if ( secondParity != DemodBuffer[127] ) {
151 PrintAndLog("2st 64bit parity check failed: %d|%d ", DemodBuffer[127], secondParity);
152 //return 0;
153 }
532bcd71 154
56bbb25a 155 // ok valid card found!
2d1885f1 156 uint32_t uid = 0;
157 uid = bytebits_to_byte(DemodBuffer+65, 8);
158 uid |= bytebits_to_byte(DemodBuffer+74, 8) << 8;
159 uid |= bytebits_to_byte(DemodBuffer+83, 8) << 16;
160
161 uint16_t two = 0;
162 two = bytebits_to_byte(DemodBuffer+92, 8);
163 two |= bytebits_to_byte(DemodBuffer+101, 8) << 8;
56bbb25a 164
2d1885f1 165 uint16_t chksum2 = 0;
166 chksum2 = bytebits_to_byte(DemodBuffer+110, 8);
167 chksum2 |= bytebits_to_byte(DemodBuffer+119, 8) << 8;
168
169 PrintAndLog("NEDAP ID Found - Raw: %08x%08x%08x%08x", raw[3], raw[2], raw[1], raw[0]);
170 PrintAndLog(" - UID: %06X", uid);
171 PrintAndLog(" - i: %04X", two);
172 PrintAndLog(" - Checksum2 %04X", chksum2);
173
56bbb25a 174 if (g_debugMode){
175 PrintAndLog("DEBUG: idx: %d, Len: %d, Printing Demod Buffer:", idx, 128);
176 printDemodBuff();
2d1885f1 177 PrintAndLog("BIN:\n%s", sprint_bin_break( DemodBuffer, 128, 64) );
56bbb25a 178 }
c71f4da9 179
56bbb25a 180 return 1;
181}
c71f4da9 182/*
2d1885f1 183configuration
184lf t55xx wr b 0 d 00170082
185
1861) uid 049033
c71f4da9 187lf t55 wr b 1 d FF8B4168
188lf t55 wr b 2 d C90B5359
189lf t55 wr b 3 d 19A40087
190lf t55 wr b 4 d 120115CF
56bbb25a 191
2d1885f1 1922) uid 001630
c71f4da9 193lf t55 wr b 1 d FF8B6B20
194lf t55 wr b 2 d F19B84A3
195lf t55 wr b 3 d 18058007
196lf t55 wr b 4 d 1200857C
197
2d1885f1 1983) uid 39feff
199lf t55xx wr b 1 d ffbfa73e
200lf t55xx wr b 2 d 4c0003ff
201lf t55xx wr b 3 d ffbfa73e
202lf t55xx wr b 4 d 4c0003ff
203
c71f4da9 204*/
56bbb25a 205
206int CmdLFNedapRead(const char *Cmd) {
207 CmdLFRead("s");
208 getSamples("30000",false);
c71f4da9 209 return CmdLFNedapDemod("");
56bbb25a 210}
211/*
212int CmdLFNedapClone(const char *Cmd) {
213
214 char cmdp = param_getchar(Cmd, 0);
215 if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_nedap_clone();
216
217 uint32_t cardnumber=0, cn = 0;
218 uint32_t blocks[5];
219 uint8_t i;
220 uint8_t bs[128];
221 memset(bs, 0x00, sizeof(bs));
222
223 if (sscanf(Cmd, "%u", &cn ) != 1) return usage_lf_nedap_clone();
224
225 cardnumber = (cn & 0x00FFFFFF);
226
227 if ( !GetNedapBits(cardnumber, bs)) {
228 PrintAndLog("Error with tag bitstream generation.");
229 return 1;
230 }
231
232 ((ASK/biphase data rawdemod ab 0 64 1 0
233 //NEDAP - compat mode, ASK/Biphase, data rate 64, 4 data blocks
234 blocks[0] = T55x7_MODULATION_BIPHASE | T55x7_BITRATE_RF_64 | 4<<T55x7_MAXBLOCK_SHIFT;
235
236 if (param_getchar(Cmd, 3) == 'Q' || param_getchar(Cmd, 3) == 'q')
890ae3dd 237 //t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
56bbb25a 238 blocks[0] = T5555_MODULATION_BIPHASE | T5555_INVERT_OUTPUT | 64<<T5555_BITRATE_SHIFT | 4<<T5555_MAXBLOCK_SHIFT;
239
240 blocks[1] = bytebits_to_byte(bs,32);
241 blocks[2] = bytebits_to_byte(bs+32,32);
242 blocks[3] = bytebits_to_byte(bs+64,32);
243 blocks[4] = bytebits_to_byte(bs+96,32);
244
245 PrintAndLog("Preparing to clone NEDAP to T55x7 with card number: %u", cardnumber);
246 PrintAndLog("Blk | Data ");
247 PrintAndLog("----+------------");
248 for ( i = 0; i<5; ++i )
249 PrintAndLog(" %02d | %08" PRIx32, i, blocks[i]);
250
251 UsbCommand resp;
252 UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}};
253
254 for ( i = 0; i<5; ++i ) {
255 c.arg[0] = blocks[i];
256 c.arg[1] = i;
257 clearCommandBuffer();
258 SendCommand(&c);
259 if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){
260 PrintAndLog("Error occurred, device did not respond during write operation.");
261 return -1;
262 }
263 }
264 return 0;
265}
266*/
267
268int CmdLFNedapSim(const char *Cmd) {
269
270 char cmdp = param_getchar(Cmd, 0);
271 if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_nedap_sim();
272
273 uint32_t cardnumber = 0, cn = 0;
274
275 uint8_t bs[128];
276 size_t size = sizeof(bs);
277 memset(bs, 0x00, size);
278
279 // NEDAP, Bihase = 2, clock 64, inverted,
280 uint8_t encoding = 2, separator = 0, clk=64, invert=1;
281 uint16_t arg1, arg2;
282 arg1 = clk << 8 | encoding;
283 arg2 = invert << 8 | separator;
284
285 if (sscanf(Cmd, "%u", &cn ) != 2) return usage_lf_nedap_sim();
286 cardnumber = (cn & 0x00FFFFFF);
287
288 if ( !GetNedapBits(cardnumber, bs)) {
289 PrintAndLog("Error with tag bitstream generation.");
290 return 1;
291 }
292
293 PrintAndLog("Simulating Nedap - CardNumber: %u", cardnumber );
294
295 UsbCommand c = {CMD_ASK_SIM_TAG, {arg1, arg2, size}};
296 memcpy(c.d.asBytes, bs, size);
297 clearCommandBuffer();
298 SendCommand(&c);
299 return 0;
300}
301
812513bf 302
303
c71f4da9 304int CmdLFNedapChk(const char *Cmd){
305
532bcd71 306 uint8_t data[256] = { 0x30, 0x16, 0x00, 0x71, 0x40, 0x21, 0xBE};
c71f4da9 307 int len = 0;
308 param_gethex_ex(Cmd, 0, data, &len);
309
310 len = ( len == 0 ) ? 5 : len>>1;
311
312 PrintAndLog("Input: [%d] %s", len, sprint_hex(data, len));
313
812513bf 314 //uint8_t last = GetParity(data, EVEN, 62);
315 //PrintAndLog("TEST PARITY:: %d | %d ", DemodBuffer[62], last);
532bcd71 316
c71f4da9 317 uint8_t cl = 0x1D, ch = 0x1D, carry = 0;
318 uint8_t al, bl, temp;
319
320 for (int i = 0; i < len; ++i){
321 al = data[i];
322 for (int j = 8; j > 0; --j) {
323
324 bl = al ^ ch;
325 //printf("BL %02x | CH %02x \n", al, ch);
326
327 carry = (cl & 0x80) ? 1 : 0;
328 cl <<= 1;
329
330 temp = (ch & 0x80) ? 1 : 0;
331 ch = (ch << 1) | carry;
332 carry = temp;
333
334 carry = (al & 0x80) ? 1 : 0;
335 al <<= 1;
336
337 carry = (bl & 0x80) ? 1 : 0;
338 bl <<= 1;
339
340 if (carry) {
341 cl ^= 0x21;
342 ch ^= 0x10;
343 }
344 }
345 }
346
347 PrintAndLog("Nedap checksum: [ 0x21, 0xBE ] %x", ((ch << 8) | cl) );
348 return 0;
349}
350
351
56bbb25a 352static command_t CommandTable[] = {
353 {"help", CmdHelp, 1, "This help"},
c71f4da9 354 {"read", CmdLFNedapRead, 0, "Attempt to read and extract tag data"},
355// {"clone", CmdLFNedapClone,0, "<Card Number> clone nedap tag"},
356 {"sim", CmdLFNedapSim, 0, "<Card Number> simulate nedap tag"},
357 {"chk", CmdLFNedapChk, 1, "Calculate Nedap Checksum <uid bytes>"},
56bbb25a 358 {NULL, NULL, 0, NULL}
359};
360
361int CmdLFNedap(const char *Cmd) {
362 clearCommandBuffer();
363 CmdsParse(CommandTable, Cmd);
364 return 0;
365}
366
367int CmdHelp(const char *Cmd) {
368 CmdsHelp(CommandTable);
369 return 0;
370}
Impressum, Datenschutz