[proxmark3-svn] / client / cmdlfnedap.c

//-----------------------------------------------------------------------------
//
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
// at your option, any later version. See the LICENSE.txt file for the text of
// the license.
//-----------------------------------------------------------------------------
// Low frequency NEDAP tag commands
//-----------------------------------------------------------------------------
#include <string.h>
#include <inttypes.h>
#include "cmdlfnedap.h"
static int CmdHelp(const char *Cmd);

int usage_lf_nedap_clone(void){
	PrintAndLog("clone a NEDAP tag to a T55x7 tag.");
	PrintAndLog("");
	PrintAndLog("Usage: lf nedap clone <Card-Number>");
	PrintAndLog("Options :");
	PrintAndLog("  <Card Number>   : 24-bit value card number");
//	PrintAndLog("  Q5              : optional - clone to Q5 (T5555) instead of T55x7 chip");
	PrintAndLog("");
	PrintAndLog("Sample  : lf nedap clone 112233");
	return 0;
}

int usage_lf_nedap_sim(void) {
	PrintAndLog("Enables simulation of NEDAP card with specified card number.");
	PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
	PrintAndLog("");
	PrintAndLog("Usage:  lf nedap sim <Card-Number>");
	PrintAndLog("Options :");
	PrintAndLog("  <Card Number>   : 24-bit value card number");
	PrintAndLog("");
	PrintAndLog("Sample  : lf nedap sim 112233");
	return 0;
}

int GetNedapBits(uint32_t cn, uint8_t *nedapBits) {

	uint8_t pre[128];
	memset(pre, 0x00, sizeof(pre));

	// preamble  1111 1111 10 = 0XF8
	num_to_bytebits(0xF8, 10, pre);

	// fixed tagtype code?  0010 1101 = 0x2D
	num_to_bytebits(0x2D, 8, pre+10);
	
	// 46 encrypted bits - UNKNOWN ALGO
	//    -- 16 bits checksum. Should be 4x4 checksum,  based on UID and 2 constant values.
	//    -- 30 bits undocumented?  
	num_to_bytebits(cn, 46, pre+18);

	//----from this part, the UID in clear text, with a 1bit ZERO as separator between bytes.
	pre[64] = 0;

	// cardnumber
	num_to_bytebits(cn, 24, pre+64);

	pre[73] = 0;
	pre[82] = 0;
	pre[91] = 0;
	pre[100] = 0;
	pre[109] = 0;
	pre[118] = 0;
	
	// add paritybits	(bitsource, dest, sourcelen, paritylen, parityType (odd, even,)
	addParity(pre+64, pre+64, 128, 8, 1);
//1111111110001011010000010110100011001001000010110101001101011001000110011010010000000000100001110001001000000001000101011100111
	return 1;
}

//NEDAP demod - ASK/Biphase,  RF/64 with preamble of 1111111110  (always a 128 bit data stream)
//print NEDAP Prox ID, encoding, encrypted ID, 
int CmdFSKdemodNedap(const char *Cmd) {
	//raw ask demod no start bit finding just get binary from wave
	uint8_t BitStream[MAX_GRAPH_TRACE_LEN]={0};
	size_t size = getFromGraphBuf(BitStream);
	if (size==0) return 0;

	//get binary from ask wave
	if (!ASKbiphaseDemod("0 64 1 0", FALSE)) {
		if (g_debugMode) PrintAndLog("Error NEDAP: ASKbiphaseDemod failed");
		return 0;
	}
	
	size = DemodBufferLen;

	int idx = NedapDemod(BitStream, &size);
	if (idx < 0){
		if (g_debugMode){
			if (idx == -5)
				PrintAndLog("DEBUG: Error - not enough samples");
			else if (idx == -1)
				PrintAndLog("DEBUG: Error - only noise found");
			else if (idx == -2)
				PrintAndLog("DEBUG: Error - problem during ASK/Biphase demod");
			else if (idx == -3)
				PrintAndLog("DEBUG: Error - Size not correct: %d", size);
			else if (idx == -4)
				PrintAndLog("DEBUG: Error - NEDAP preamble not found");
			else
				PrintAndLog("DEBUG: Error - idx: %d",idx);
		}
		return 0;
	}

/* Index map
0        10        20          30            40          50        64
|        |         |           |             |           |         |
 preamble    enc tag type         encrypted uid                    d    33    d    90    p    04    d    71    d    40    d    45    d    E7    P
1111111110 00101101000001011 0100011001001000010110101001101011001 0 00110011 0 10010000 0 00000100 0 01110001 0 01000000 0 01000101 0 11100111 1
                                                                       uid2       uid1       uid0         I          I          R           R    
	 Tag ID is 049033 
	 I = Identical on all tags
	 R = Random ?
	 UID2, UID1, UID0 == card number
*/

	//get raw ID before removing parities
	uint32_t rawLo = bytebits_to_byte(BitStream+idx+96,32);
	uint32_t rawHi = bytebits_to_byte(BitStream+idx+64,32);
	uint32_t rawHi2 = bytebits_to_byte(BitStream+idx+32,32);
	uint32_t rawHi3 = bytebits_to_byte(BitStream+idx,32);
	setDemodBuf(BitStream,128,idx);

	// ok valid card found!
	uint32_t cardnum = bytebits_to_byte(BitStream+81, 16);
	PrintAndLog("NEDAP ID Found - Card: %d - Raw: %08x%08x%08x%08x", cardnum, rawHi3, rawHi2, rawHi, rawLo);
	
	if (g_debugMode){
		PrintAndLog("DEBUG: idx: %d, Len: %d, Printing Demod Buffer:", idx, 128);
		printDemodBuff();
	}
	return 1;
}


int CmdLFNedapRead(const char *Cmd) {
	CmdLFRead("s");
	getSamples("30000",false);
	return CmdFSKdemodNedap("");
}
/*
int CmdLFNedapClone(const char *Cmd) {

	char cmdp = param_getchar(Cmd, 0);
	if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_nedap_clone();

	uint32_t cardnumber=0, cn = 0;
	uint32_t blocks[5];
	uint8_t i;
	uint8_t bs[128];
	memset(bs, 0x00, sizeof(bs));

	if (sscanf(Cmd, "%u", &cn ) != 1) return usage_lf_nedap_clone();

	cardnumber = (cn & 0x00FFFFFF);
	
	if ( !GetNedapBits(cardnumber, bs)) {
		PrintAndLog("Error with tag bitstream generation.");
		return 1;
	}	

	((ASK/biphase   data rawdemod ab 0 64 1 0
	//NEDAP - compat mode, ASK/Biphase, data rate 64, 4 data blocks
	blocks[0] = T55x7_MODULATION_BIPHASE | T55x7_BITRATE_RF_64 | 4<<T55x7_MAXBLOCK_SHIFT;

	if (param_getchar(Cmd, 3) == 'Q' || param_getchar(Cmd, 3) == 'q')
		blocks[0] = T5555_MODULATION_BIPHASE | T5555_INVERT_OUTPUT | 64<<T5555_BITRATE_SHIFT | 4<<T5555_MAXBLOCK_SHIFT;

	blocks[1] = bytebits_to_byte(bs,32);
	blocks[2] = bytebits_to_byte(bs+32,32);
	blocks[3] = bytebits_to_byte(bs+64,32);
	blocks[4] = bytebits_to_byte(bs+96,32);

	PrintAndLog("Preparing to clone NEDAP to T55x7 with card number: %u", cardnumber);
	PrintAndLog("Blk | Data ");
	PrintAndLog("----+------------");
	for ( i = 0; i<5; ++i )
		PrintAndLog(" %02d | %08" PRIx32, i, blocks[i]);

	UsbCommand resp;
	UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}};

	for ( i = 0; i<5; ++i ) {
		c.arg[0] = blocks[i];
		c.arg[1] = i;
		clearCommandBuffer();
		SendCommand(&c);
		if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){
			PrintAndLog("Error occurred, device did not respond during write operation.");
			return -1;
		}
	}
    return 0;
}
*/

int CmdLFNedapSim(const char *Cmd) {

	char cmdp = param_getchar(Cmd, 0);
	if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_nedap_sim();

	uint32_t cardnumber = 0, cn = 0;
	
	uint8_t bs[128];
	size_t size = sizeof(bs);
	memset(bs, 0x00, size);
	
	// NEDAP,  Bihase = 2, clock 64, inverted, 
	uint8_t encoding = 2, separator = 0, clk=64, invert=1;
	uint16_t arg1, arg2;
	arg1 = clk << 8 | encoding;
	arg2 = invert << 8 | separator;

	if (sscanf(Cmd, "%u", &cn ) != 2) return usage_lf_nedap_sim();
	cardnumber = (cn & 0x00FFFFFF);
	
	if ( !GetNedapBits(cardnumber, bs)) {
		PrintAndLog("Error with tag bitstream generation.");
		return 1;
	}	

	PrintAndLog("Simulating Nedap - CardNumber: %u", cardnumber );
	
	UsbCommand c = {CMD_ASK_SIM_TAG, {arg1, arg2, size}};
	memcpy(c.d.asBytes, bs, size);
	clearCommandBuffer();
	SendCommand(&c);
	return 0;
}

static command_t CommandTable[] = {
    {"help",	CmdHelp,		1, "This help"},
	{"read",	CmdLFNedapRead,  0, "Attempt to read and extract tag data"},
//	{"clone",	CmdLFNedapClone, 0, "<Card Number>  clone nedap tag"},
	{"sim",		CmdLFNedapSim,   0, "<Card Number>  simulate nedap tag"},
    {NULL, NULL, 0, NULL}
};

int CmdLFNedap(const char *Cmd) {
	clearCommandBuffer();
    CmdsParse(CommandTable, Cmd);
    return 0;
}

int CmdHelp(const char *Cmd) {
    CmdsHelp(CommandTable);
    return 0;
}
Commit	Line	Data
56bbb25a	1	//-----------------------------------------------------------------------------
	2	//
	3	// This code is licensed to you under the terms of the GNU GPL, version 2 or,
	4	// at your option, any later version. See the LICENSE.txt file for the text of
	5	// the license.
	6	//-----------------------------------------------------------------------------
	7	// Low frequency NEDAP tag commands
	8	//-----------------------------------------------------------------------------
	9	#include <string.h>
	10	#include <inttypes.h>
	11	#include "cmdlfnedap.h"
	12	static int CmdHelp(const char *Cmd);
	13
	14	int usage_lf_nedap_clone(void){
	15	PrintAndLog("clone a NEDAP tag to a T55x7 tag.");
	16	PrintAndLog("");
	17	PrintAndLog("Usage: lf nedap clone <Card-Number>");
	18	PrintAndLog("Options :");
	19	PrintAndLog(" <Card Number> : 24-bit value card number");
	20	// PrintAndLog(" Q5 : optional - clone to Q5 (T5555) instead of T55x7 chip");
	21	PrintAndLog("");
	22	PrintAndLog("Sample : lf nedap clone 112233");
	23	return 0;
	24	}
	25
	26	int usage_lf_nedap_sim(void) {
	27	PrintAndLog("Enables simulation of NEDAP card with specified card number.");
	28	PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
	29	PrintAndLog("");
	30	PrintAndLog("Usage: lf nedap sim <Card-Number>");
	31	PrintAndLog("Options :");
	32	PrintAndLog(" <Card Number> : 24-bit value card number");
	33	PrintAndLog("");
	34	PrintAndLog("Sample : lf nedap sim 112233");
	35	return 0;
	36	}
	37
	38	int GetNedapBits(uint32_t cn, uint8_t *nedapBits) {
	39
	40	uint8_t pre[128];
	41	memset(pre, 0x00, sizeof(pre));
	42
	43	// preamble 1111 1111 10 = 0XF8
	44	num_to_bytebits(0xF8, 10, pre);
	45
	46	// fixed tagtype code? 0010 1101 = 0x2D
	47	num_to_bytebits(0x2D, 8, pre+10);
	48
	49	// 46 encrypted bits - UNKNOWN ALGO
	50	// -- 16 bits checksum. Should be 4x4 checksum, based on UID and 2 constant values.
	51	// -- 30 bits undocumented?
	52	num_to_bytebits(cn, 46, pre+18);
	53
	54	//----from this part, the UID in clear text, with a 1bit ZERO as separator between bytes.
	55	pre[64] = 0;
	56
	57	// cardnumber
	58	num_to_bytebits(cn, 24, pre+64);
	59
	60	pre[73] = 0;
	61	pre[82] = 0;
	62	pre[91] = 0;
	63	pre[100] = 0;
	64	pre[109] = 0;
65	pre[118] = 0;
66
67	// add paritybits (bitsource, dest, sourcelen, paritylen, parityType (odd, even,)
68	addParity(pre+64, pre+64, 128, 8, 1);
69	//1111111110001011010000010110100011001001000010110101001101011001000110011010010000000000100001110001001000000001000101011100111
70	return 1;
71	}
72
73	//NEDAP demod - ASK/Biphase, RF/64 with preamble of 1111111110 (always a 128 bit data stream)
74	//print NEDAP Prox ID, encoding, encrypted ID,
75	int CmdFSKdemodNedap(const char *Cmd) {
76	//raw ask demod no start bit finding just get binary from wave
77	uint8_t BitStream[MAX_GRAPH_TRACE_LEN]={0};
78	size_t size = getFromGraphBuf(BitStream);
79	if (size==0) return 0;
80
96faed21	81	//get binary from ask wave
	82	if (!ASKbiphaseDemod("0 64 1 0", FALSE)) {
	83	if (g_debugMode) PrintAndLog("Error NEDAP: ASKbiphaseDemod failed");
	84	return 0;
	85	}
d34a0b0c	86
d34a0b0c	87	size = DemodBufferLen;
96faed21	88
56bbb25a	89	int idx = NedapDemod(BitStream, &size);
	90	if (idx < 0){
	91	if (g_debugMode){
	92	if (idx == -5)
	93	PrintAndLog("DEBUG: Error - not enough samples");
	94	else if (idx == -1)
	95	PrintAndLog("DEBUG: Error - only noise found");
	96	else if (idx == -2)
	97	PrintAndLog("DEBUG: Error - problem during ASK/Biphase demod");
	98	else if (idx == -3)
	99	PrintAndLog("DEBUG: Error - Size not correct: %d", size);
	100	else if (idx == -4)
	101	PrintAndLog("DEBUG: Error - NEDAP preamble not found");
	102	else
	103	PrintAndLog("DEBUG: Error - idx: %d",idx);
	104	}
	105	return 0;
	106	}
	107
	108	/* Index map
	109	0 10 20 30 40 50 64
	110	\| \| \| \| \| \| \|
	111	preamble enc tag type encrypted uid d 33 d 90 p 04 d 71 d 40 d 45 d E7 P
	112	1111111110 00101101000001011 0100011001001000010110101001101011001 0 00110011 0 10010000 0 00000100 0 01110001 0 01000000 0 01000101 0 11100111 1
	113	uid2 uid1 uid0 I I R R
	114	Tag ID is 049033
	115	I = Identical on all tags
	116	R = Random ?
	117	UID2, UID1, UID0 == card number
	118	*/
	119
	120	//get raw ID before removing parities
	121	uint32_t rawLo = bytebits_to_byte(BitStream+idx+96,32);
	122	uint32_t rawHi = bytebits_to_byte(BitStream+idx+64,32);
	123	uint32_t rawHi2 = bytebits_to_byte(BitStream+idx+32,32);
	124	uint32_t rawHi3 = bytebits_to_byte(BitStream+idx,32);
	125	setDemodBuf(BitStream,128,idx);
	126
	127	// ok valid card found!
	128	uint32_t cardnum = bytebits_to_byte(BitStream+81, 16);
	129	PrintAndLog("NEDAP ID Found - Card: %d - Raw: %08x%08x%08x%08x", cardnum, rawHi3, rawHi2, rawHi, rawLo);
	130
	131	if (g_debugMode){
	132	PrintAndLog("DEBUG: idx: %d, Len: %d, Printing Demod Buffer:", idx, 128);
	133	printDemodBuff();
	134	}
	135	return 1;
	136	}
	137
	138
	139	int CmdLFNedapRead(const char *Cmd) {
	140	CmdLFRead("s");
	141	getSamples("30000",false);
	142	return CmdFSKdemodNedap("");
	143	}
	144	/*
	145	int CmdLFNedapClone(const char *Cmd) {
	146
	147	char cmdp = param_getchar(Cmd, 0);
	148	if (strlen(Cmd) == 0 \|\| cmdp == 'h' \|\| cmdp == 'H') return usage_lf_nedap_clone();
	149
	150	uint32_t cardnumber=0, cn = 0;
	151	uint32_t blocks[5];
	152	uint8_t i;
153	uint8_t bs[128];
154	memset(bs, 0x00, sizeof(bs));
155
156	if (sscanf(Cmd, "%u", &cn ) != 1) return usage_lf_nedap_clone();
157
158	cardnumber = (cn & 0x00FFFFFF);
159
160	if ( !GetNedapBits(cardnumber, bs)) {
161	PrintAndLog("Error with tag bitstream generation.");
162	return 1;
163	}
164
165	((ASK/biphase data rawdemod ab 0 64 1 0
166	//NEDAP - compat mode, ASK/Biphase, data rate 64, 4 data blocks
167	blocks[0] = T55x7_MODULATION_BIPHASE \| T55x7_BITRATE_RF_64 \| 4<<T55x7_MAXBLOCK_SHIFT;
168
169	if (param_getchar(Cmd, 3) == 'Q' \|\| param_getchar(Cmd, 3) == 'q')
170	blocks[0] = T5555_MODULATION_BIPHASE \| T5555_INVERT_OUTPUT \| 64<<T5555_BITRATE_SHIFT \| 4<<T5555_MAXBLOCK_SHIFT;
171
172	blocks[1] = bytebits_to_byte(bs,32);
173	blocks[2] = bytebits_to_byte(bs+32,32);
174	blocks[3] = bytebits_to_byte(bs+64,32);
175	blocks[4] = bytebits_to_byte(bs+96,32);
176
177	PrintAndLog("Preparing to clone NEDAP to T55x7 with card number: %u", cardnumber);
178	PrintAndLog("Blk \| Data ");
179	PrintAndLog("----+------------");
180	for ( i = 0; i<5; ++i )
181	PrintAndLog(" %02d \| %08" PRIx32, i, blocks[i]);
182
183	UsbCommand resp;
184	UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}};
185
186	for ( i = 0; i<5; ++i ) {
187	c.arg[0] = blocks[i];
188	c.arg[1] = i;
189	clearCommandBuffer();
190	SendCommand(&c);
191	if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){
192	PrintAndLog("Error occurred, device did not respond during write operation.");
193	return -1;
194	}
195	}
196	return 0;
197	}
198	*/
199
200	int CmdLFNedapSim(const char *Cmd) {
201
202	char cmdp = param_getchar(Cmd, 0);
203	if (strlen(Cmd) == 0 \|\| cmdp == 'h' \|\| cmdp == 'H') return usage_lf_nedap_sim();
204
205	uint32_t cardnumber = 0, cn = 0;
206
207	uint8_t bs[128];
208	size_t size = sizeof(bs);
209	memset(bs, 0x00, size);
210
211	// NEDAP, Bihase = 2, clock 64, inverted,
212	uint8_t encoding = 2, separator = 0, clk=64, invert=1;
213	uint16_t arg1, arg2;
214	arg1 = clk << 8 \| encoding;
215	arg2 = invert << 8 \| separator;
216
217	if (sscanf(Cmd, "%u", &cn ) != 2) return usage_lf_nedap_sim();
218	cardnumber = (cn & 0x00FFFFFF);
219
220	if ( !GetNedapBits(cardnumber, bs)) {
221	PrintAndLog("Error with tag bitstream generation.");
222	return 1;
223	}
224
225	PrintAndLog("Simulating Nedap - CardNumber: %u", cardnumber );
226
227	UsbCommand c = {CMD_ASK_SIM_TAG, {arg1, arg2, size}};
228	memcpy(c.d.asBytes, bs, size);
229	clearCommandBuffer();
230	SendCommand(&c);
231	return 0;
232	}
233
234	static command_t CommandTable[] = {
235	{"help", CmdHelp, 1, "This help"},
236	{"read", CmdLFNedapRead, 0, "Attempt to read and extract tag data"},
237	// {"clone", CmdLFNedapClone, 0, "<Card Number> clone nedap tag"},
238	{"sim", CmdLFNedapSim, 0, "<Card Number> simulate nedap tag"},
239	{NULL, NULL, 0, NULL}
240	};
241
242	int CmdLFNedap(const char *Cmd) {
243	clearCommandBuffer();
244	CmdsParse(CommandTable, Cmd);
245	return 0;
246	}
247
248	int CmdHelp(const char *Cmd) {
249	CmdsHelp(CommandTable);
250	return 0;
251	}