]> git.zerfleddert.de Git - proxmark3-svn/blame - client/cmdlfguard.c
ADD: `analyse nuid` - generates NUID 4byte from a UID 7byte. Mifare Classic Ev1...
[proxmark3-svn] / client / cmdlfguard.c
CommitLineData
50564be0 1//-----------------------------------------------------------------------------
2//
3// This code is licensed to you under the terms of the GNU GPL, version 2 or,
4// at your option, any later version. See the LICENSE.txt file for the text of
5// the license.
6//-----------------------------------------------------------------------------
7// Low frequency Farpoint / Pyramid tag commands
8//-----------------------------------------------------------------------------
42c235e7 9
50564be0 10#include "cmdlfguard.h"
11static int CmdHelp(const char *Cmd);
12
13int usage_lf_guard_clone(void){
14 PrintAndLog("clone a Guardall tag to a T55x7 tag.");
15 PrintAndLog("The facility-code is 8-bit and the card number is 16-bit. Larger values are truncated. ");
16 PrintAndLog("Currently work only on 26bit");
17 PrintAndLog("");
ff9c043d 18 PrintAndLog("Usage: lf guard clone <format> <Facility-Code> <Card-Number>");
50564be0 19 PrintAndLog("Options :");
ff9c043d 20 PrintAndLog(" <format> : format length 26|32|36|40");
50564be0 21 PrintAndLog(" <Facility-Code> : 8-bit value facility code");
22 PrintAndLog(" <Card Number> : 16-bit value card number");
23 PrintAndLog("");
da952d12 24 PrintAndLog("Sample : lf guard clone 26 123 11223");
50564be0 25 return 0;
26}
27
28int usage_lf_guard_sim(void) {
29 PrintAndLog("Enables simulation of Guardall card with specified card number.");
30 PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
31 PrintAndLog("The facility-code is 8-bit and the card number is 16-bit. Larger values are truncated.");
32 PrintAndLog("Currently work only on 26bit");
33 PrintAndLog("");
03d73c0b 34 PrintAndLog("Usage: lf guard sim <format> <Facility-Code> <Card-Number>");
50564be0 35 PrintAndLog("Options :");
ff9c043d 36 PrintAndLog(" <format> : format length 26|32|36|40");
50564be0 37 PrintAndLog(" <Facility-Code> : 8-bit value facility code");
38 PrintAndLog(" <Card Number> : 16-bit value card number");
39 PrintAndLog("");
03d73c0b 40 PrintAndLog("Sample : lf guard sim 26 123 11223");
50564be0 41 return 0;
42}
43
50564be0 44// Works for 26bits.
ff9c043d 45int GetGuardBits(uint8_t fmtlen, uint32_t fc, uint32_t cn, uint8_t *guardBits) {
50564be0 46
c728b2b4 47 uint8_t xorKey = 0x66;
0d2c5909 48 uint8_t i;
0d2c5909 49 uint8_t pre[96];
ff9c043d 50 uint8_t rawbytes[12];
0d2c5909 51 memset(pre, 0x00, sizeof(pre));
ff9c043d 52 memset(rawbytes, 0x00, sizeof(rawbytes));
50564be0 53
ff9c043d 54 // add format length (decimal)
55 switch (fmtlen) {
56 case 32: {
57 rawbytes[1] = (32 << 2);
58
59 break;
60 }
61 case 36: {
62 // FC = ((ByteStream[3] & 0x7F)<<7) | (ByteStream[4]>>1);
63 // Card = ((ByteStream[4]&1)<<19) | (ByteStream[5]<<11) | (ByteStream[6]<<3) | (ByteStream[7]>>5);
64 rawbytes[1] = (36 << 2);
65 // Get 26 wiegand from FacilityCode, CardNumber
66 uint8_t wiegand[34];
67 memset(wiegand, 0x00, sizeof(wiegand));
68 num_to_bytebits(fc, 8, wiegand);
69 num_to_bytebits(cn, 26, wiegand+8);
70
71 // add wiegand parity bits (dest, source, len)
72 wiegand_add_parity(pre, wiegand, 34);
73 break;
74 }
75 case 40: {
76 rawbytes[1] = (40 << 2);
77 break;
78 }
79 case 26:
80 default: {
81 rawbytes[1] = (26 << 2);
82 // Get 26 wiegand from FacilityCode, CardNumber
83 uint8_t wiegand[24];
84 memset(wiegand, 0x00, sizeof(wiegand));
85 num_to_bytebits(fc, 8, wiegand);
86 num_to_bytebits(cn, 16, wiegand+8);
87
88 // add wiegand parity bits (dest, source, len)
89 wiegand_add_parity(pre, wiegand, 24);
90 break;
91 }
92 }
93 // 2bit checksum, unknown today,
94 // these two bits are the last ones of rawbyte[1], hence the LSHIFT above.
0d2c5909 95
ff9c043d 96
0d2c5909 97 // xor key
98 rawbytes[0] = xorKey;
0d2c5909 99
0d2c5909 100 rawbytes[2] = 1;
101 rawbytes[3] = 0;
50564be0 102
0d2c5909 103 // add wiegand to rawbytes
104 for (i = 0; i < 4; ++i)
105 rawbytes[i+4] = bytebits_to_byte( pre + (i*8), 8);
50564be0 106
0d2c5909 107 if (g_debugMode) printf(" WIE | %s\n", sprint_hex(rawbytes, sizeof(rawbytes)));
50564be0 108
ff9c043d 109
0d2c5909 110 // XOR (only works on wiegand stuff)
111 for (i = 1; i < 12; ++i)
112 rawbytes[i] ^= xorKey ;
113
114 if (g_debugMode) printf(" XOR | %s \n", sprint_hex(rawbytes, sizeof(rawbytes)));
115
116 // convert rawbytes to bits in pre
117 for (i = 0; i < 12; ++i)
118 num_to_bytebitsLSBF( rawbytes[i], 8, pre + (i*8));
119
120 if (g_debugMode) printf("\n Raw | %s \n", sprint_hex(rawbytes, sizeof(rawbytes)));
121 if (g_debugMode) printf(" Raw | %s\n", sprint_bin(pre, 64) );
122
123 // add spacer bit 0 every 4 bits, starting with index 0,
07291f87 124 // 12 bytes, 24 nibbles. 24+1 extra bites. 3bytes. ie 9bytes | 1byte xorkey, 8bytes rawdata (64bits, should be enough for a 40bit wiegand)
0d2c5909 125 addParity(pre, guardBits+6, 64, 5, 3);
126
127 // preamble
128 guardBits[0] = 1;
129 guardBits[1] = 1;
130 guardBits[2] = 1;
131 guardBits[3] = 1;
132 guardBits[4] = 1;
133 guardBits[5] = 0;
0d2c5909 134
135 if (g_debugMode) printf(" FIN | %s\n", sprint_bin(guardBits, 96) );
50564be0 136 return 1;
137}
138
139int CmdGuardRead(const char *Cmd) {
140 CmdLFRead("s");
42c235e7 141 getSamples("12000", TRUE);
50564be0 142 return CmdG_Prox_II_Demod("");
143}
144
145int CmdGuardClone(const char *Cmd) {
146
147 char cmdp = param_getchar(Cmd, 0);
148 if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_guard_clone();
149
ff9c043d 150 uint32_t facilitycode = 0, cardnumber = 0, fc = 0, cn = 0, fmtlen = 0;
50564be0 151 uint8_t i;
152 uint8_t bs[96];
153 memset(bs, 0x00, sizeof(bs));
154
155 //GuardProxII - compat mode, ASK/Biphase, data rate 64, 3 data blocks
ff9c043d 156 uint32_t blocks[5] = {T55x7_MODULATION_BIPHASE | T55x7_BITRATE_RF_64 | 3 << T55x7_MAXBLOCK_SHIFT, 0, 0, 0, 0};
50564be0 157
ff9c043d 158 if (param_getchar(Cmd, 3) == 'Q' || param_getchar(Cmd, 3) == 'q')
159 //t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
160 blocks[0] = T5555_MODULATION_FSK2 | ((50-2)>>1) << T5555_BITRATE_SHIFT | 3 << T5555_MAXBLOCK_SHIFT;
50564be0 161
da952d12 162 if (sscanf(Cmd, "%u %u %u", &fmtlen, &fc, &cn ) != 3) return usage_lf_guard_clone();
50564be0 163
ff9c043d 164 fmtlen &= 0x7f;
50564be0 165 facilitycode = (fc & 0x000000FF);
166 cardnumber = (cn & 0x0000FFFF);
167
ff9c043d 168 if ( !GetGuardBits(fmtlen, facilitycode, cardnumber, bs)) {
50564be0 169 PrintAndLog("Error with tag bitstream generation.");
170 return 1;
171 }
172
173 blocks[1] = bytebits_to_byte(bs,32);
174 blocks[2] = bytebits_to_byte(bs+32,32);
175 blocks[3] = bytebits_to_byte(bs+64,32);
176
177 PrintAndLog("Preparing to clone Guardall to T55x7 with Facility Code: %u, Card Number: %u", facilitycode, cardnumber);
178 PrintAndLog("Blk | Data ");
179 PrintAndLog("----+------------");
180 for ( i = 0; i<4; ++i )
42c235e7 181 PrintAndLog(" %02d | 0x%08x", i, blocks[i]);
50564be0 182
0d2c5909 183 UsbCommand resp;
184 UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}};
185
186 for ( i = 0; i<4; ++i ) {
187 c.arg[0] = blocks[i];
188 c.arg[1] = i;
189 clearCommandBuffer();
190 SendCommand(&c);
42c235e7 191 if (!WaitForResponseTimeout(CMD_ACK, &resp, T55XX_WRITE_TIMEOUT)){
0d2c5909 192 PrintAndLog("Error occurred, device did not respond during write operation.");
193 return -1;
194 }
195 }
50564be0 196 return 0;
197}
198
199int CmdGuardSim(const char *Cmd) {
200
201 char cmdp = param_getchar(Cmd, 0);
202 if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_guard_sim();
203
ff9c043d 204 uint32_t facilitycode = 0, cardnumber = 0, fc = 0, cn = 0, fmtlen = 0;
07291f87 205 uint8_t clock = 64, encoding = 2, separator = 0, invert = 0;
50564be0 206
207 uint8_t bs[96];
07291f87 208 memset(bs, 0x00, sizeof(bs));
50564be0 209
03d73c0b 210 if (sscanf(Cmd, "%u %u %u", &fmtlen, &fc, &cn ) != 3) return usage_lf_guard_sim();
50564be0 211
ff9c043d 212 fmtlen &= 0x7F;
50564be0 213 facilitycode = (fc & 0x000000FF);
214 cardnumber = (cn & 0x0000FFFF);
215
ff9c043d 216 if ( !GetGuardBits(fmtlen, facilitycode, cardnumber, bs)) {
50564be0 217 PrintAndLog("Error with tag bitstream generation.");
218 return 1;
219 }
220
221 PrintAndLog("Simulating Guardall - Facility Code: %u, CardNumber: %u", facilitycode, cardnumber );
07291f87 222
223 // Guard uses: clk: 64, invert: 0, encoding: 2 (ASK Biphase)
224 uint64_t arg1, arg2;
225 arg1 = (clock << 8) | encoding;
226 arg2 = (invert << 8) | separator;
227
228 uint8_t rawbytes[12];
229 size_t size = sizeof(rawbytes);
230 for (uint8_t i=0; i < size; ++i){
231 rawbytes[i] = bytebits_to_byte( bs + (i*8), 8);
232 }
233
50564be0 234 UsbCommand c = {CMD_ASK_SIM_TAG, {arg1, arg2, size}};
07291f87 235 memcpy(c.d.asBytes, rawbytes, size );
50564be0 236 clearCommandBuffer();
237 SendCommand(&c);
238 return 0;
239}
240
241static command_t CommandTable[] = {
242 {"help", CmdHelp, 1, "This help"},
243 {"read", CmdGuardRead, 0, "Attempt to read and extract tag data"},
0d2c5909 244 {"clone", CmdGuardClone, 0, "<Facility-Code> <Card Number> clone Guardall tag"},
07291f87 245 {"sim", CmdGuardSim, 0, "<Facility-Code> <Card Number> simulate Guardall tag"},
50564be0 246 {NULL, NULL, 0, NULL}
247};
248
249int CmdLFGuard(const char *Cmd) {
250 clearCommandBuffer();
251 CmdsParse(CommandTable, Cmd);
252 return 0;
253}
254
255int CmdHelp(const char *Cmd) {
256 CmdsHelp(CommandTable);
257 return 0;
258}
Impressum, Datenschutz