]> git.zerfleddert.de Git - proxmark3-svn/blame - client/cmdlfguard.c
syntax sugar
[proxmark3-svn] / client / cmdlfguard.c
CommitLineData
50564be0 1//-----------------------------------------------------------------------------
2//
3// This code is licensed to you under the terms of the GNU GPL, version 2 or,
4// at your option, any later version. See the LICENSE.txt file for the text of
5// the license.
6//-----------------------------------------------------------------------------
7// Low frequency Farpoint / Pyramid tag commands
8//-----------------------------------------------------------------------------
42c235e7 9
50564be0 10#include "cmdlfguard.h"
11static int CmdHelp(const char *Cmd);
12
13int usage_lf_guard_clone(void){
14 PrintAndLog("clone a Guardall tag to a T55x7 tag.");
15 PrintAndLog("The facility-code is 8-bit and the card number is 16-bit. Larger values are truncated. ");
16 PrintAndLog("Currently work only on 26bit");
17 PrintAndLog("");
18 PrintAndLog("Usage: lf guard clone <Facility-Code> <Card-Number>");
19 PrintAndLog("Options :");
20 PrintAndLog(" <Facility-Code> : 8-bit value facility code");
21 PrintAndLog(" <Card Number> : 16-bit value card number");
22 PrintAndLog("");
23 PrintAndLog("Sample : lf guard clone 123 11223");
24 return 0;
25}
26
27int usage_lf_guard_sim(void) {
28 PrintAndLog("Enables simulation of Guardall card with specified card number.");
29 PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
30 PrintAndLog("The facility-code is 8-bit and the card number is 16-bit. Larger values are truncated.");
31 PrintAndLog("Currently work only on 26bit");
32 PrintAndLog("");
33 PrintAndLog("Usage: lf guard sim <Card-Number>");
34 PrintAndLog("Options :");
35 PrintAndLog(" <Facility-Code> : 8-bit value facility code");
36 PrintAndLog(" <Card Number> : 16-bit value card number");
37 PrintAndLog("");
38 PrintAndLog("Sample : lf guard sim 123 11223");
39 return 0;
40}
41
50564be0 42// Works for 26bits.
43int GetGuardBits(uint32_t fc, uint32_t cn, uint8_t *guardBits) {
44
45 // Intializes random number generator
46 time_t t;
47 srand((unsigned) time(&t));
0d2c5909 48 //uint8_t xorKey = rand() % 0xFF;
c728b2b4 49 uint8_t xorKey = 0x66;
0d2c5909 50 uint8_t i;
0d2c5909 51 uint8_t pre[96];
52 memset(pre, 0x00, sizeof(pre));
50564be0 53
50564be0 54 // Get 26 wiegand from FacilityCode, CardNumber
55 uint8_t wiegand[24];
56 memset(wiegand, 0x00, sizeof(wiegand));
57 num_to_bytebits(fc, 8, wiegand);
58 num_to_bytebits(cn, 16, wiegand+8);
59
60 // add wiegand parity bits (dest, source, len)
0d2c5909 61 wiegand_add_parity(pre, wiegand, 24);
50564be0 62
0d2c5909 63 // lets start. 12bytes of data to be produced.
64 uint8_t rawbytes[12];
65 memset(rawbytes, 0x00, sizeof(rawbytes));
66
67 // xor key
68 rawbytes[0] = xorKey;
69
70 // add format length (decimal)
71 // len | hex | bin
72 // 26 | 1A | 0001 1010
73 rawbytes[1] = (26 << 2);
74 // 36 | 24 | 0010 0100
75 //rawbytes[1] = (36 << 2);
76 // 40 | 28 | 0010 1000
77 //rawbytes[1] = (40 << 2);
78
79 // 2bit checksum, unknown today,
80 // these two bits are the last ones of rawbyte[1], hence the LSHIFT above.
81 rawbytes[2] = 1;
82 rawbytes[3] = 0;
50564be0 83
0d2c5909 84 // add wiegand to rawbytes
85 for (i = 0; i < 4; ++i)
86 rawbytes[i+4] = bytebits_to_byte( pre + (i*8), 8);
50564be0 87
0d2c5909 88 if (g_debugMode) printf(" WIE | %s\n", sprint_hex(rawbytes, sizeof(rawbytes)));
50564be0 89
0d2c5909 90 // XOR (only works on wiegand stuff)
91 for (i = 1; i < 12; ++i)
92 rawbytes[i] ^= xorKey ;
93
94 if (g_debugMode) printf(" XOR | %s \n", sprint_hex(rawbytes, sizeof(rawbytes)));
95
96 // convert rawbytes to bits in pre
97 for (i = 0; i < 12; ++i)
98 num_to_bytebitsLSBF( rawbytes[i], 8, pre + (i*8));
99
100 if (g_debugMode) printf("\n Raw | %s \n", sprint_hex(rawbytes, sizeof(rawbytes)));
101 if (g_debugMode) printf(" Raw | %s\n", sprint_bin(pre, 64) );
102
103 // add spacer bit 0 every 4 bits, starting with index 0,
07291f87 104 // 12 bytes, 24 nibbles. 24+1 extra bites. 3bytes. ie 9bytes | 1byte xorkey, 8bytes rawdata (64bits, should be enough for a 40bit wiegand)
0d2c5909 105 addParity(pre, guardBits+6, 64, 5, 3);
106
107 // preamble
108 guardBits[0] = 1;
109 guardBits[1] = 1;
110 guardBits[2] = 1;
111 guardBits[3] = 1;
112 guardBits[4] = 1;
113 guardBits[5] = 0;
0d2c5909 114
115 if (g_debugMode) printf(" FIN | %s\n", sprint_bin(guardBits, 96) );
50564be0 116 return 1;
117}
118
119int CmdGuardRead(const char *Cmd) {
120 CmdLFRead("s");
42c235e7 121 getSamples("12000", TRUE);
50564be0 122 return CmdG_Prox_II_Demod("");
123}
124
125int CmdGuardClone(const char *Cmd) {
126
127 char cmdp = param_getchar(Cmd, 0);
128 if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_guard_clone();
129
130 uint32_t facilitycode=0, cardnumber=0, fc = 0, cn = 0;
131 uint8_t i;
132 uint8_t bs[96];
133 memset(bs, 0x00, sizeof(bs));
134
135 //GuardProxII - compat mode, ASK/Biphase, data rate 64, 3 data blocks
136 uint32_t blocks[5] = {T55x7_MODULATION_BIPHASE | T55x7_BITRATE_RF_64 | 3<<T55x7_MAXBLOCK_SHIFT, 0, 0, 0, 0};
137
138// if (param_getchar(Cmd, 3) == 'Q' || param_getchar(Cmd, 3) == 'q')
890ae3dd 139 //t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
50564be0 140// blocks[0] = T5555_MODULATION_FSK2 | 50<<T5555_BITRATE_SHIFT | 4<<T5555_MAXBLOCK_SHIFT;
141
142 if (sscanf(Cmd, "%u %u", &fc, &cn ) != 2) return usage_lf_guard_clone();
143
144 facilitycode = (fc & 0x000000FF);
145 cardnumber = (cn & 0x0000FFFF);
146
147 if ( !GetGuardBits(facilitycode, cardnumber, bs)) {
148 PrintAndLog("Error with tag bitstream generation.");
149 return 1;
150 }
151
152 blocks[1] = bytebits_to_byte(bs,32);
153 blocks[2] = bytebits_to_byte(bs+32,32);
154 blocks[3] = bytebits_to_byte(bs+64,32);
155
156 PrintAndLog("Preparing to clone Guardall to T55x7 with Facility Code: %u, Card Number: %u", facilitycode, cardnumber);
157 PrintAndLog("Blk | Data ");
158 PrintAndLog("----+------------");
159 for ( i = 0; i<4; ++i )
42c235e7 160 PrintAndLog(" %02d | 0x%08x", i, blocks[i]);
50564be0 161
0d2c5909 162 UsbCommand resp;
163 UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}};
164
165 for ( i = 0; i<4; ++i ) {
166 c.arg[0] = blocks[i];
167 c.arg[1] = i;
168 clearCommandBuffer();
169 SendCommand(&c);
42c235e7 170 if (!WaitForResponseTimeout(CMD_ACK, &resp, T55XX_WRITE_TIMEOUT)){
0d2c5909 171 PrintAndLog("Error occurred, device did not respond during write operation.");
172 return -1;
173 }
174 }
50564be0 175 return 0;
176}
177
178int CmdGuardSim(const char *Cmd) {
179
180 char cmdp = param_getchar(Cmd, 0);
181 if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_guard_sim();
182
183 uint32_t facilitycode = 0, cardnumber = 0, fc = 0, cn = 0;
07291f87 184 uint8_t clock = 64, encoding = 2, separator = 0, invert = 0;
50564be0 185
186 uint8_t bs[96];
07291f87 187 memset(bs, 0x00, sizeof(bs));
50564be0 188
50564be0 189 if (sscanf(Cmd, "%u %u", &fc, &cn ) != 2) return usage_lf_guard_sim();
190
191 facilitycode = (fc & 0x000000FF);
192 cardnumber = (cn & 0x0000FFFF);
193
194 if ( !GetGuardBits(facilitycode, cardnumber, bs)) {
195 PrintAndLog("Error with tag bitstream generation.");
196 return 1;
197 }
198
199 PrintAndLog("Simulating Guardall - Facility Code: %u, CardNumber: %u", facilitycode, cardnumber );
07291f87 200
201 // Guard uses: clk: 64, invert: 0, encoding: 2 (ASK Biphase)
202 uint64_t arg1, arg2;
203 arg1 = (clock << 8) | encoding;
204 arg2 = (invert << 8) | separator;
205
206 uint8_t rawbytes[12];
207 size_t size = sizeof(rawbytes);
208 for (uint8_t i=0; i < size; ++i){
209 rawbytes[i] = bytebits_to_byte( bs + (i*8), 8);
210 }
211
50564be0 212 UsbCommand c = {CMD_ASK_SIM_TAG, {arg1, arg2, size}};
07291f87 213 memcpy(c.d.asBytes, rawbytes, size );
50564be0 214 clearCommandBuffer();
215 SendCommand(&c);
216 return 0;
217}
218
219static command_t CommandTable[] = {
220 {"help", CmdHelp, 1, "This help"},
221 {"read", CmdGuardRead, 0, "Attempt to read and extract tag data"},
0d2c5909 222 {"clone", CmdGuardClone, 0, "<Facility-Code> <Card Number> clone Guardall tag"},
07291f87 223 {"sim", CmdGuardSim, 0, "<Facility-Code> <Card Number> simulate Guardall tag"},
50564be0 224 {NULL, NULL, 0, NULL}
225};
226
227int CmdLFGuard(const char *Cmd) {
228 clearCommandBuffer();
229 CmdsParse(CommandTable, Cmd);
230 return 0;
231}
232
233int CmdHelp(const char *Cmd) {
234 CmdsHelp(CommandTable);
235 return 0;
236}
Impressum, Datenschutz