]>
Commit | Line | Data |
---|---|---|
dbf6e824 CY |
1 | //----------------------------------------------------------------------------- |
2 | // Authored by Craig Young <cyoung@tripwire.com> based on cmdlfhid.c structure | |
3 | // | |
4 | // cmdlfhid.c is Copyright (C) 2010 iZsh <izsh at fail0verflow.com> | |
5 | // | |
6 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, | |
7 | // at your option, any later version. See the LICENSE.txt file for the text of | |
8 | // the license. | |
9 | //----------------------------------------------------------------------------- | |
10 | // Low frequency AWID26 commands | |
b9957414 | 11 | // FSK2a, RF/50, 96 bits (complete) |
dbf6e824 CY |
12 | //----------------------------------------------------------------------------- |
13 | ||
ad939de5 | 14 | #include "cmdlfawid.h" |
15 | ||
acf0582d | 16 | #include <string.h> |
dbf6e824 | 17 | #include <stdio.h> // sscanf |
ad939de5 | 18 | #include "comms.h" // Definitions, USB controls, etc |
dbf6e824 CY |
19 | #include "ui.h" // PrintAndLog |
20 | #include "cmdparser.h" // CmdsParse, CmdsHelp | |
6cd2eef4 | 21 | #include "lfdemod.h" // parityTest + |
709665b5 | 22 | #include "util.h" // weigandparity |
23 | #include "protocols.h" // for T55xx config register definitions | |
6cd2eef4 | 24 | #include "cmddata.h" // for printDemod and demodbuffer commands |
25 | #include "graph.h" // for getFromGraphBuff cmds | |
976627d5 | 26 | #include "cmdmain.h" |
dbf6e824 | 27 | |
709665b5 | 28 | static int CmdHelp(const char *Cmd); |
bcffcca2 | 29 | |
6cd2eef4 | 30 | int usage_lf_awid_read(void) { |
37824afe MHS |
31 | PrintAndLog("Enables AWID26 compatible reader mode printing details of scanned AWID26 tags."); |
32 | PrintAndLog("By default, values are printed and logged until the button is pressed or another USB command is issued."); | |
33 | PrintAndLog("If the ['1'] option is provided, reader mode is exited after reading a single AWID26 card."); | |
34 | PrintAndLog(""); | |
6cd2eef4 | 35 | PrintAndLog("Usage: lf awid read ['1']"); |
709665b5 | 36 | PrintAndLog("Options : "); |
37824afe MHS |
37 | PrintAndLog(" 1 : (optional) stop after reading a single card"); |
38 | PrintAndLog(""); | |
6cd2eef4 | 39 | PrintAndLog("Samples : lf awid read"); |
40 | PrintAndLog(" : lf awid read 1"); | |
37824afe | 41 | return 0; |
bcffcca2 CY |
42 | } |
43 | ||
44 | int usage_lf_awid_sim(void) { | |
37824afe MHS |
45 | PrintAndLog("Enables simulation of AWID26 card with specified facility-code and card number."); |
46 | PrintAndLog("Simulation runs until the button is pressed or another USB command is issued."); | |
47 | PrintAndLog("Per AWID26 format, the facility-code is 8-bit and the card number is 16-bit. Larger values are truncated."); | |
48 | PrintAndLog(""); | |
49 | PrintAndLog("Usage: lf awid sim <Facility-Code> <Card-Number>"); | |
709665b5 | 50 | PrintAndLog("Options : "); |
37824afe MHS |
51 | PrintAndLog(" <Facility-Code> : 8-bit value representing the AWID facility code"); |
52 | PrintAndLog(" <Card Number> : 16-bit value representing the AWID card number"); | |
53 | PrintAndLog(""); | |
709665b5 | 54 | PrintAndLog("Sample : lf awid sim 224 1337"); |
37824afe | 55 | return 0; |
bcffcca2 CY |
56 | } |
57 | ||
58 | int usage_lf_awid_clone(void) { | |
37824afe MHS |
59 | PrintAndLog("Enables cloning of AWID26 card with specified facility-code and card number onto T55x7."); |
60 | PrintAndLog("The T55x7 must be on the antenna when issuing this command. T55x7 blocks are calculated and printed in the process."); | |
61 | PrintAndLog("Per AWID26 format, the facility-code is 8-bit and the card number is 16-bit. Larger values are truncated."); | |
62 | PrintAndLog(""); | |
63 | PrintAndLog("Usage: lf awid clone <Facility-Code> <Card-Number>"); | |
709665b5 | 64 | PrintAndLog("Options : "); |
37824afe MHS |
65 | PrintAndLog(" <Facility-Code> : 8-bit value representing the AWID facility code"); |
66 | PrintAndLog(" <Card Number> : 16-bit value representing the AWID card number"); | |
709665b5 | 67 | PrintAndLog(" Q5 : optional - clone to Q5 (T5555) instead of T55x7 chip"); |
37824afe | 68 | PrintAndLog(""); |
709665b5 | 69 | PrintAndLog("Sample : lf awid clone 224 1337"); |
37824afe | 70 | return 0; |
bcffcca2 CY |
71 | } |
72 | ||
6cd2eef4 | 73 | int CmdAWIDReadFSK(const char *Cmd) { |
37824afe | 74 | int findone=0; |
6cd2eef4 | 75 | if (Cmd[0] == 'h' || Cmd[0] == 'H') return usage_lf_awid_read(); |
709665b5 | 76 | if (Cmd[0] == '1') findone = 1; |
77 | ||
78 | UsbCommand c = {CMD_AWID_DEMOD_FSK, {findone, 0, 0}}; | |
79 | clearCommandBuffer(); | |
37824afe MHS |
80 | SendCommand(&c); |
81 | return 0; | |
dbf6e824 | 82 | } |
6cd2eef4 | 83 | //by marshmellow |
84 | //AWID Prox demod - FSK RF/50 with preamble of 00000001 (always a 96 bit data stream) | |
85 | //print full AWID Prox ID and some bit format details if found | |
86 | int CmdFSKdemodAWID(const char *Cmd) | |
87 | { | |
88 | uint8_t BitStream[MAX_GRAPH_TRACE_LEN]={0}; | |
89 | size_t size = getFromGraphBuf(BitStream); | |
90 | if (size==0) return 0; | |
91 | ||
1c70664a | 92 | int waveIdx = 0; |
6cd2eef4 | 93 | //get binary from fsk wave |
1c70664a | 94 | int idx = AWIDdemodFSK(BitStream, &size, &waveIdx); |
6cd2eef4 | 95 | if (idx<=0){ |
96 | if (g_debugMode){ | |
97 | if (idx == -1) | |
98 | PrintAndLog("DEBUG: Error - not enough samples"); | |
99 | else if (idx == -2) | |
100 | PrintAndLog("DEBUG: Error - only noise found"); | |
101 | else if (idx == -3) | |
102 | PrintAndLog("DEBUG: Error - problem during FSK demod"); | |
103 | else if (idx == -4) | |
104 | PrintAndLog("DEBUG: Error - AWID preamble not found"); | |
105 | else if (idx == -5) | |
106 | PrintAndLog("DEBUG: Error - Size not correct: %d", size); | |
107 | else | |
108 | PrintAndLog("DEBUG: Error %d",idx); | |
109 | } | |
110 | return 0; | |
111 | } | |
112 | ||
113 | // Index map | |
114 | // 0 10 20 30 40 50 60 | |
115 | // | | | | | | | | |
116 | // 01234567 890 1 234 5 678 9 012 3 456 7 890 1 234 5 678 9 012 3 456 7 890 1 234 5 678 9 012 3 - to 96 | |
117 | // ----------------------------------------------------------------------------- | |
118 | // 00000001 000 1 110 1 101 1 011 1 101 1 010 0 000 1 000 1 010 0 001 0 110 1 100 0 000 1 000 1 | |
119 | // premable bbb o bbb o bbw o fff o fff o ffc o ccc o ccc o ccc o ccc o ccc o wxx o xxx o xxx o - to 96 | |
120 | // |---26 bit---| |-----117----||-------------142-------------| | |
121 | // b = format bit len, o = odd parity of last 3 bits | |
122 | // f = facility code, c = card number | |
123 | // w = wiegand parity | |
124 | // (26 bit format shown) | |
125 | ||
126 | //get raw ID before removing parities | |
127 | uint32_t rawLo = bytebits_to_byte(BitStream+idx+64,32); | |
128 | uint32_t rawHi = bytebits_to_byte(BitStream+idx+32,32); | |
129 | uint32_t rawHi2 = bytebits_to_byte(BitStream+idx,32); | |
130 | setDemodBuf(BitStream,96,idx); | |
1c70664a | 131 | setClockGrid(50, waveIdx + (idx*50)); |
6cd2eef4 | 132 | |
133 | size = removeParity(BitStream, idx+8, 4, 1, 88); | |
134 | if (size != 66){ | |
135 | if (g_debugMode) PrintAndLog("DEBUG: Error - at parity check-tag size does not match AWID format"); | |
136 | return 0; | |
137 | } | |
138 | // ok valid card found! | |
139 | ||
140 | // Index map | |
141 | // 0 10 20 30 40 50 60 | |
142 | // | | | | | | | | |
143 | // 01234567 8 90123456 7890123456789012 3 456789012345678901234567890123456 | |
144 | // ----------------------------------------------------------------------------- | |
145 | // 00011010 1 01110101 0000000010001110 1 000000000000000000000000000000000 | |
146 | // bbbbbbbb w ffffffff cccccccccccccccc w xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx | |
147 | // |26 bit| |-117--| |-----142------| | |
148 | // b = format bit len, o = odd parity of last 3 bits | |
149 | // f = facility code, c = card number | |
150 | // w = wiegand parity | |
151 | // (26 bit format shown) | |
152 | ||
153 | uint32_t fc = 0; | |
154 | uint32_t cardnum = 0; | |
155 | uint32_t code1 = 0; | |
156 | uint32_t code2 = 0; | |
157 | uint8_t fmtLen = bytebits_to_byte(BitStream,8); | |
158 | if (fmtLen==26){ | |
159 | fc = bytebits_to_byte(BitStream+9, 8); | |
160 | cardnum = bytebits_to_byte(BitStream+17, 16); | |
161 | code1 = bytebits_to_byte(BitStream+8,fmtLen); | |
162 | PrintAndLog("AWID Found - BitLength: %d, FC: %d, Card: %d - Wiegand: %x, Raw: %08x%08x%08x", fmtLen, fc, cardnum, code1, rawHi2, rawHi, rawLo); | |
163 | } else { | |
164 | cardnum = bytebits_to_byte(BitStream+8+(fmtLen-17), 16); | |
165 | if (fmtLen>32){ | |
166 | code1 = bytebits_to_byte(BitStream+8,fmtLen-32); | |
167 | code2 = bytebits_to_byte(BitStream+8+(fmtLen-32),32); | |
168 | PrintAndLog("AWID Found - BitLength: %d -unknown BitLength- (%d) - Wiegand: %x%08x, Raw: %08x%08x%08x", fmtLen, cardnum, code1, code2, rawHi2, rawHi, rawLo); | |
169 | } else{ | |
170 | code1 = bytebits_to_byte(BitStream+8,fmtLen); | |
171 | PrintAndLog("AWID Found - BitLength: %d -unknown BitLength- (%d) - Wiegand: %x, Raw: %08x%08x%08x", fmtLen, cardnum, code1, rawHi2, rawHi, rawLo); | |
172 | } | |
173 | } | |
174 | if (g_debugMode){ | |
175 | PrintAndLog("DEBUG: idx: %d, Len: %d Printing Demod Buffer:", idx, 96); | |
176 | printDemodBuff(); | |
177 | } | |
178 | //todo - convert hi2, hi, lo to demodbuffer for future sim/clone commands | |
179 | return 1; | |
180 | } | |
dbf6e824 | 181 | |
709665b5 | 182 | //refactored by marshmellow |
183 | int getAWIDBits(uint32_t fc, uint32_t cn, uint8_t *AWIDBits) { | |
184 | uint8_t pre[66]; | |
185 | memset(pre, 0, sizeof(pre)); | |
186 | AWIDBits[7]=1; | |
187 | num_to_bytebits(26, 8, pre); | |
188 | ||
189 | uint8_t wiegand[24]; | |
190 | num_to_bytebits(fc, 8, wiegand); | |
191 | num_to_bytebits(cn, 16, wiegand+8); | |
192 | ||
193 | wiegand_add_parity(pre+8, wiegand, 24); | |
194 | ||
195 | size_t bitLen = addParity(pre, AWIDBits+8, 66, 4, 1); | |
196 | if (bitLen != 88) return 0; | |
197 | //for (uint8_t i = 0; i<3; i++){ | |
198 | // PrintAndLog("DEBUG: %08X", bytebits_to_byte(AWIDBits+(32*i),32)); | |
199 | //} | |
37824afe | 200 | return 1; |
dbf6e824 CY |
201 | } |
202 | ||
709665b5 | 203 | int CmdAWIDSim(const char *Cmd) { |
204 | uint32_t fcode = 0, cnum = 0, fc=0, cn=0; | |
205 | uint8_t BitStream[96]; | |
206 | uint8_t *bs = BitStream; | |
207 | size_t size = sizeof(BitStream); | |
208 | memset(bs, 0, size); | |
209 | ||
37824afe MHS |
210 | uint64_t arg1 = (10<<8) + 8; // fcHigh = 10, fcLow = 8 |
211 | uint64_t arg2 = 50; // clk RF/50 invert=0 | |
709665b5 | 212 | |
213 | if (sscanf(Cmd, "%u %u", &fc, &cn ) != 2) return usage_lf_awid_sim(); | |
214 | ||
215 | fcode = (fc & 0x000000FF); | |
216 | cnum = (cn & 0x0000FFFF); | |
217 | ||
218 | if (fc != fcode) PrintAndLog("Facility-Code (%u) truncated to 8-bits: %u",fc,fcode); | |
219 | if (cn != cnum) PrintAndLog("Card number (%u) truncated to 16-bits: %u",cn,cnum); | |
37824afe | 220 | |
37824afe MHS |
221 | PrintAndLog("Emulating AWID26 -- FC: %u; CN: %u\n",fcode,cnum); |
222 | PrintAndLog("Press pm3-button to abort simulation or run another command"); | |
709665b5 | 223 | |
224 | if (!getAWIDBits(fc, cn, bs)) { | |
225 | PrintAndLog("Error with tag bitstream generation."); | |
226 | return 1; | |
227 | } | |
37824afe | 228 | // AWID uses: fcHigh: 10, fcLow: 8, clk: 50, invert: 0 |
709665b5 | 229 | UsbCommand c = {CMD_FSK_SIM_TAG, {arg1, arg2, size}}; |
230 | memcpy(c.d.asBytes, bs, size); | |
231 | clearCommandBuffer(); | |
37824afe MHS |
232 | SendCommand(&c); |
233 | return 0; | |
dbf6e824 CY |
234 | } |
235 | ||
709665b5 | 236 | int CmdAWIDClone(const char *Cmd) { |
237 | uint32_t blocks[4] = {T55x7_MODULATION_FSK2a | T55x7_BITRATE_RF_50 | 3<<T55x7_MAXBLOCK_SHIFT, 0, 0, 0}; | |
238 | uint32_t fc=0,cn=0; | |
239 | uint8_t BitStream[96]; | |
240 | uint8_t *bs=BitStream; | |
241 | memset(bs,0,sizeof(BitStream)); | |
37824afe | 242 | |
709665b5 | 243 | if (sscanf(Cmd, "%u %u", &fc, &cn ) != 2) return usage_lf_awid_clone(); |
244 | ||
245 | if (param_getchar(Cmd, 3) == 'Q' || param_getchar(Cmd, 3) == 'q') | |
6f1a5978 | 246 | blocks[0] = T5555_MODULATION_FSK2 | T5555_INVERT_OUTPUT | ((50-2)>>1)<<T5555_BITRATE_SHIFT | 3<<T5555_MAXBLOCK_SHIFT; |
37824afe MHS |
247 | |
248 | if ((fc & 0xFF) != fc) { | |
249 | fc &= 0xFF; | |
250 | PrintAndLog("Facility-Code Truncated to 8-bits (AWID26): %u", fc); | |
251 | } | |
252 | if ((cn & 0xFFFF) != cn) { | |
253 | cn &= 0xFFFF; | |
254 | PrintAndLog("Card Number Truncated to 16-bits (AWID26): %u", cn); | |
255 | } | |
976627d5 | 256 | |
709665b5 | 257 | if ( !getAWIDBits(fc, cn, bs)) { |
258 | PrintAndLog("Error with tag bitstream generation."); | |
259 | return 1; | |
260 | } | |
261 | ||
262 | blocks[1] = bytebits_to_byte(bs,32); | |
263 | blocks[2] = bytebits_to_byte(bs+32,32); | |
264 | blocks[3] = bytebits_to_byte(bs+64,32); | |
265 | ||
266 | PrintAndLog("Preparing to clone AWID26 to T55x7 with FC: %u, CN: %u", | |
267 | fc, cn); | |
268 | PrintAndLog("Blk | Data "); | |
269 | PrintAndLog("----+------------"); | |
270 | PrintAndLog(" 00 | 0x%08x", blocks[0]); | |
271 | PrintAndLog(" 01 | 0x%08x", blocks[1]); | |
272 | PrintAndLog(" 02 | 0x%08x", blocks[2]); | |
273 | PrintAndLog(" 03 | 0x%08x", blocks[3]); | |
274 | ||
275 | UsbCommand resp; | |
276 | UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}}; | |
277 | ||
278 | for (uint8_t i=0; i<4; i++) { | |
279 | c.cmd = CMD_T55XX_WRITE_BLOCK; | |
280 | c.arg[0] = blocks[i]; | |
281 | c.arg[1] = i; | |
282 | c.arg[2] = 0; | |
283 | clearCommandBuffer(); | |
284 | SendCommand(&c); | |
285 | if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){ | |
286 | PrintAndLog("Error occurred, device did not respond during write operation."); | |
287 | return -1; | |
37824afe | 288 | } |
709665b5 | 289 | |
37824afe MHS |
290 | } |
291 | return 0; | |
dbf6e824 CY |
292 | } |
293 | ||
709665b5 | 294 | static command_t CommandTable[] = { |
295 | {"help", CmdHelp, 1, "This help"}, | |
6cd2eef4 | 296 | {"demod", CmdFSKdemodAWID, 1, "Demodulate an AWID FSK tag from the GraphBuffer"}, |
297 | {"read", CmdAWIDReadFSK, 0, "['1'] Realtime AWID FSK read from the antenna (option '1' for one tag only)"}, | |
37824afe | 298 | {"sim", CmdAWIDSim, 0, "<Facility-Code> <Card Number> -- AWID tag simulator"}, |
709665b5 | 299 | {"clone", CmdAWIDClone, 0, "<Facility-Code> <Card Number> <Q5> -- Clone AWID to T55x7 (tag must be in range of antenna)"}, |
37824afe | 300 | {NULL, NULL, 0, NULL} |
dbf6e824 CY |
301 | }; |
302 | ||
709665b5 | 303 | int CmdLFAWID(const char *Cmd) { |
37824afe MHS |
304 | CmdsParse(CommandTable, Cmd); |
305 | return 0; | |
dbf6e824 CY |
306 | } |
307 | ||
709665b5 | 308 | int CmdHelp(const char *Cmd) { |
37824afe MHS |
309 | CmdsHelp(CommandTable); |
310 | return 0; | |
dbf6e824 | 311 | } |