]>
Commit | Line | Data |
---|---|---|
56bbb25a | 1 | //----------------------------------------------------------------------------- |
2 | // | |
3 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, | |
4 | // at your option, any later version. See the LICENSE.txt file for the text of | |
5 | // the license. | |
6 | //----------------------------------------------------------------------------- | |
7 | // Low frequency NEDAP tag commands | |
8 | //----------------------------------------------------------------------------- | |
9 | #include <string.h> | |
10 | #include <inttypes.h> | |
11 | #include "cmdlfnedap.h" | |
12 | static int CmdHelp(const char *Cmd); | |
13 | ||
14 | int usage_lf_nedap_clone(void){ | |
15 | PrintAndLog("clone a NEDAP tag to a T55x7 tag."); | |
16 | PrintAndLog(""); | |
17 | PrintAndLog("Usage: lf nedap clone <Card-Number>"); | |
18 | PrintAndLog("Options :"); | |
19 | PrintAndLog(" <Card Number> : 24-bit value card number"); | |
20 | // PrintAndLog(" Q5 : optional - clone to Q5 (T5555) instead of T55x7 chip"); | |
21 | PrintAndLog(""); | |
22 | PrintAndLog("Sample : lf nedap clone 112233"); | |
23 | return 0; | |
24 | } | |
25 | ||
26 | int usage_lf_nedap_sim(void) { | |
27 | PrintAndLog("Enables simulation of NEDAP card with specified card number."); | |
28 | PrintAndLog("Simulation runs until the button is pressed or another USB command is issued."); | |
29 | PrintAndLog(""); | |
30 | PrintAndLog("Usage: lf nedap sim <Card-Number>"); | |
31 | PrintAndLog("Options :"); | |
32 | PrintAndLog(" <Card Number> : 24-bit value card number"); | |
33 | PrintAndLog(""); | |
34 | PrintAndLog("Sample : lf nedap sim 112233"); | |
35 | return 0; | |
36 | } | |
37 | ||
38 | int GetNedapBits(uint32_t cn, uint8_t *nedapBits) { | |
39 | ||
40 | uint8_t pre[128]; | |
41 | memset(pre, 0x00, sizeof(pre)); | |
42 | ||
43 | // preamble 1111 1111 10 = 0XF8 | |
44 | num_to_bytebits(0xF8, 10, pre); | |
45 | ||
46 | // fixed tagtype code? 0010 1101 = 0x2D | |
47 | num_to_bytebits(0x2D, 8, pre+10); | |
48 | ||
49 | // 46 encrypted bits - UNKNOWN ALGO | |
50 | // -- 16 bits checksum. Should be 4x4 checksum, based on UID and 2 constant values. | |
51 | // -- 30 bits undocumented? | |
52 | num_to_bytebits(cn, 46, pre+18); | |
53 | ||
54 | //----from this part, the UID in clear text, with a 1bit ZERO as separator between bytes. | |
55 | pre[64] = 0; | |
56 | ||
57 | // cardnumber | |
58 | num_to_bytebits(cn, 24, pre+64); | |
59 | ||
60 | pre[73] = 0; | |
61 | pre[82] = 0; | |
62 | pre[91] = 0; | |
63 | pre[100] = 0; | |
64 | pre[109] = 0; | |
65 | pre[118] = 0; | |
66 | ||
67 | // add paritybits (bitsource, dest, sourcelen, paritylen, parityType (odd, even,) | |
68 | addParity(pre+64, pre+64, 128, 8, 1); | |
c71f4da9 | 69 | |
56bbb25a | 70 | //1111111110001011010000010110100011001001000010110101001101011001000110011010010000000000100001110001001000000001000101011100111 |
71 | return 1; | |
72 | } | |
73 | ||
c71f4da9 | 74 | //GetParity( uint8_t *bits, uint8_t type, int length) |
75 | ||
56bbb25a | 76 | //NEDAP demod - ASK/Biphase, RF/64 with preamble of 1111111110 (always a 128 bit data stream) |
77 | //print NEDAP Prox ID, encoding, encrypted ID, | |
c71f4da9 | 78 | |
79 | int CmdLFNedapDemod(const char *Cmd) { | |
56bbb25a | 80 | //raw ask demod no start bit finding just get binary from wave |
81 | uint8_t BitStream[MAX_GRAPH_TRACE_LEN]={0}; | |
82 | size_t size = getFromGraphBuf(BitStream); | |
83 | if (size==0) return 0; | |
84 | ||
96faed21 | 85 | //get binary from ask wave |
c71f4da9 | 86 | if (!ASKbiphaseDemod("0 64 0 0", FALSE)) { |
96faed21 | 87 | if (g_debugMode) PrintAndLog("Error NEDAP: ASKbiphaseDemod failed"); |
88 | return 0; | |
89 | } | |
d34a0b0c | 90 | size = DemodBufferLen; |
c71f4da9 | 91 | int idx = NedapDemod(DemodBuffer, &size); |
56bbb25a | 92 | if (idx < 0){ |
93 | if (g_debugMode){ | |
94 | if (idx == -5) | |
95 | PrintAndLog("DEBUG: Error - not enough samples"); | |
96 | else if (idx == -1) | |
97 | PrintAndLog("DEBUG: Error - only noise found"); | |
98 | else if (idx == -2) | |
99 | PrintAndLog("DEBUG: Error - problem during ASK/Biphase demod"); | |
100 | else if (idx == -3) | |
101 | PrintAndLog("DEBUG: Error - Size not correct: %d", size); | |
102 | else if (idx == -4) | |
103 | PrintAndLog("DEBUG: Error - NEDAP preamble not found"); | |
104 | else | |
105 | PrintAndLog("DEBUG: Error - idx: %d",idx); | |
106 | } | |
107 | return 0; | |
108 | } | |
109 | ||
110 | /* Index map | |
111 | 0 10 20 30 40 50 64 | |
112 | | | | | | | | | |
113 | preamble enc tag type encrypted uid d 33 d 90 p 04 d 71 d 40 d 45 d E7 P | |
114 | 1111111110 00101101000001011 0100011001001000010110101001101011001 0 00110011 0 10010000 0 00000100 0 01110001 0 01000000 0 01000101 0 11100111 1 | |
115 | uid2 uid1 uid0 I I R R | |
116 | Tag ID is 049033 | |
117 | I = Identical on all tags | |
118 | R = Random ? | |
119 | UID2, UID1, UID0 == card number | |
120 | */ | |
56bbb25a | 121 | //get raw ID before removing parities |
c71f4da9 | 122 | uint32_t rawLo = bytebits_to_byte(DemodBuffer+idx+96,32); |
123 | uint32_t rawHi = bytebits_to_byte(DemodBuffer+idx+64,32); | |
124 | uint32_t rawHi2 = bytebits_to_byte(DemodBuffer+idx+32,32); | |
125 | uint32_t rawHi3 = bytebits_to_byte(DemodBuffer+idx,32); | |
126 | setDemodBuf(DemodBuffer,128,idx); | |
56bbb25a | 127 | |
128 | // ok valid card found! | |
c71f4da9 | 129 | uint32_t cardnum = bytebits_to_byte(DemodBuffer+81, 16); |
56bbb25a | 130 | PrintAndLog("NEDAP ID Found - Card: %d - Raw: %08x%08x%08x%08x", cardnum, rawHi3, rawHi2, rawHi, rawLo); |
131 | ||
132 | if (g_debugMode){ | |
133 | PrintAndLog("DEBUG: idx: %d, Len: %d, Printing Demod Buffer:", idx, 128); | |
134 | printDemodBuff(); | |
135 | } | |
c71f4da9 | 136 | |
137 | uint8_t last = GetParity( DemodBuffer, EVEN, 128); | |
138 | // PrintAndLog("BIN: %s", sprint_bin_break( DemodBuffer, 128, 32) ); | |
139 | PrintAndLog("TEST: LASTPARITY %d | %d ", DemodBuffer[127], last); | |
140 | ||
56bbb25a | 141 | return 1; |
142 | } | |
c71f4da9 | 143 | /* |
144 | lf t55 wr b 1 d FF8B4168 | |
145 | lf t55 wr b 2 d C90B5359 | |
146 | lf t55 wr b 3 d 19A40087 | |
147 | lf t55 wr b 4 d 120115CF | |
56bbb25a | 148 | |
c71f4da9 | 149 | 0) |
150 | lf t55 wr b 1 d FF8B6B20 | |
151 | lf t55 wr b 2 d F19B84A3 | |
152 | lf t55 wr b 3 d 18058007 | |
153 | lf t55 wr b 4 d 1200857C | |
154 | ||
155 | */ | |
56bbb25a | 156 | |
157 | int CmdLFNedapRead(const char *Cmd) { | |
158 | CmdLFRead("s"); | |
159 | getSamples("30000",false); | |
c71f4da9 | 160 | return CmdLFNedapDemod(""); |
56bbb25a | 161 | } |
162 | /* | |
163 | int CmdLFNedapClone(const char *Cmd) { | |
164 | ||
165 | char cmdp = param_getchar(Cmd, 0); | |
166 | if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_nedap_clone(); | |
167 | ||
168 | uint32_t cardnumber=0, cn = 0; | |
169 | uint32_t blocks[5]; | |
170 | uint8_t i; | |
171 | uint8_t bs[128]; | |
172 | memset(bs, 0x00, sizeof(bs)); | |
173 | ||
174 | if (sscanf(Cmd, "%u", &cn ) != 1) return usage_lf_nedap_clone(); | |
175 | ||
176 | cardnumber = (cn & 0x00FFFFFF); | |
177 | ||
178 | if ( !GetNedapBits(cardnumber, bs)) { | |
179 | PrintAndLog("Error with tag bitstream generation."); | |
180 | return 1; | |
181 | } | |
182 | ||
183 | ((ASK/biphase data rawdemod ab 0 64 1 0 | |
184 | //NEDAP - compat mode, ASK/Biphase, data rate 64, 4 data blocks | |
185 | blocks[0] = T55x7_MODULATION_BIPHASE | T55x7_BITRATE_RF_64 | 4<<T55x7_MAXBLOCK_SHIFT; | |
186 | ||
187 | if (param_getchar(Cmd, 3) == 'Q' || param_getchar(Cmd, 3) == 'q') | |
188 | blocks[0] = T5555_MODULATION_BIPHASE | T5555_INVERT_OUTPUT | 64<<T5555_BITRATE_SHIFT | 4<<T5555_MAXBLOCK_SHIFT; | |
189 | ||
190 | blocks[1] = bytebits_to_byte(bs,32); | |
191 | blocks[2] = bytebits_to_byte(bs+32,32); | |
192 | blocks[3] = bytebits_to_byte(bs+64,32); | |
193 | blocks[4] = bytebits_to_byte(bs+96,32); | |
194 | ||
195 | PrintAndLog("Preparing to clone NEDAP to T55x7 with card number: %u", cardnumber); | |
196 | PrintAndLog("Blk | Data "); | |
197 | PrintAndLog("----+------------"); | |
198 | for ( i = 0; i<5; ++i ) | |
199 | PrintAndLog(" %02d | %08" PRIx32, i, blocks[i]); | |
200 | ||
201 | UsbCommand resp; | |
202 | UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}}; | |
203 | ||
204 | for ( i = 0; i<5; ++i ) { | |
205 | c.arg[0] = blocks[i]; | |
206 | c.arg[1] = i; | |
207 | clearCommandBuffer(); | |
208 | SendCommand(&c); | |
209 | if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){ | |
210 | PrintAndLog("Error occurred, device did not respond during write operation."); | |
211 | return -1; | |
212 | } | |
213 | } | |
214 | return 0; | |
215 | } | |
216 | */ | |
217 | ||
218 | int CmdLFNedapSim(const char *Cmd) { | |
219 | ||
220 | char cmdp = param_getchar(Cmd, 0); | |
221 | if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_nedap_sim(); | |
222 | ||
223 | uint32_t cardnumber = 0, cn = 0; | |
224 | ||
225 | uint8_t bs[128]; | |
226 | size_t size = sizeof(bs); | |
227 | memset(bs, 0x00, size); | |
228 | ||
229 | // NEDAP, Bihase = 2, clock 64, inverted, | |
230 | uint8_t encoding = 2, separator = 0, clk=64, invert=1; | |
231 | uint16_t arg1, arg2; | |
232 | arg1 = clk << 8 | encoding; | |
233 | arg2 = invert << 8 | separator; | |
234 | ||
235 | if (sscanf(Cmd, "%u", &cn ) != 2) return usage_lf_nedap_sim(); | |
236 | cardnumber = (cn & 0x00FFFFFF); | |
237 | ||
238 | if ( !GetNedapBits(cardnumber, bs)) { | |
239 | PrintAndLog("Error with tag bitstream generation."); | |
240 | return 1; | |
241 | } | |
242 | ||
243 | PrintAndLog("Simulating Nedap - CardNumber: %u", cardnumber ); | |
244 | ||
245 | UsbCommand c = {CMD_ASK_SIM_TAG, {arg1, arg2, size}}; | |
246 | memcpy(c.d.asBytes, bs, size); | |
247 | clearCommandBuffer(); | |
248 | SendCommand(&c); | |
249 | return 0; | |
250 | } | |
251 | ||
c71f4da9 | 252 | int CmdLFNedapChk(const char *Cmd){ |
253 | ||
254 | uint8_t data[20] = { 0x30, 0x16, 0x00, 0x71, 0x40, 0x21, 0xBE}; | |
255 | int len = 0; | |
256 | param_gethex_ex(Cmd, 0, data, &len); | |
257 | ||
258 | len = ( len == 0 ) ? 5 : len>>1; | |
259 | ||
260 | PrintAndLog("Input: [%d] %s", len, sprint_hex(data, len)); | |
261 | ||
262 | uint8_t cl = 0x1D, ch = 0x1D, carry = 0; | |
263 | uint8_t al, bl, temp; | |
264 | ||
265 | for (int i = 0; i < len; ++i){ | |
266 | al = data[i]; | |
267 | for (int j = 8; j > 0; --j) { | |
268 | ||
269 | bl = al ^ ch; | |
270 | //printf("BL %02x | CH %02x \n", al, ch); | |
271 | ||
272 | carry = (cl & 0x80) ? 1 : 0; | |
273 | cl <<= 1; | |
274 | ||
275 | temp = (ch & 0x80) ? 1 : 0; | |
276 | ch = (ch << 1) | carry; | |
277 | carry = temp; | |
278 | ||
279 | carry = (al & 0x80) ? 1 : 0; | |
280 | al <<= 1; | |
281 | ||
282 | carry = (bl & 0x80) ? 1 : 0; | |
283 | bl <<= 1; | |
284 | ||
285 | if (carry) { | |
286 | cl ^= 0x21; | |
287 | ch ^= 0x10; | |
288 | } | |
289 | } | |
290 | } | |
291 | ||
292 | PrintAndLog("Nedap checksum: [ 0x21, 0xBE ] %x", ((ch << 8) | cl) ); | |
293 | return 0; | |
294 | } | |
295 | ||
296 | ||
56bbb25a | 297 | static command_t CommandTable[] = { |
298 | {"help", CmdHelp, 1, "This help"}, | |
c71f4da9 | 299 | {"read", CmdLFNedapRead, 0, "Attempt to read and extract tag data"}, |
300 | // {"clone", CmdLFNedapClone,0, "<Card Number> clone nedap tag"}, | |
301 | {"sim", CmdLFNedapSim, 0, "<Card Number> simulate nedap tag"}, | |
302 | {"chk", CmdLFNedapChk, 1, "Calculate Nedap Checksum <uid bytes>"}, | |
56bbb25a | 303 | {NULL, NULL, 0, NULL} |
304 | }; | |
305 | ||
306 | int CmdLFNedap(const char *Cmd) { | |
307 | clearCommandBuffer(); | |
308 | CmdsParse(CommandTable, Cmd); | |
309 | return 0; | |
310 | } | |
311 | ||
312 | int CmdHelp(const char *Cmd) { | |
313 | CmdsHelp(CommandTable); | |
314 | return 0; | |
315 | } |