]> git.zerfleddert.de Git - proxmark3-svn/blame - client/cmdlfhid.c
chg: travis ci again
[proxmark3-svn] / client / cmdlfhid.c
CommitLineData
a553f267 1//-----------------------------------------------------------------------------
2// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
3//
4// This code is licensed to you under the terms of the GNU GPL, version 2 or,
5// at your option, any later version. See the LICENSE.txt file for the text of
6// the license.
7//-----------------------------------------------------------------------------
8// Low frequency HID commands
9//-----------------------------------------------------------------------------
10
7fe9b0b7 11#include "cmdlfhid.h"
12
13static int CmdHelp(const char *Cmd);
f4fbfb83 14
3a532acf 15int usage_lf_hid_wiegand(void){
e13ccb6b 16 PrintAndLog("This command converts facility code/card number to Wiegand code");
758f5ee3 17 PrintAndLog("Usage: lf hid wiegand [h] [OEM] [FC] [CN]");
18
f4fbfb83 19 PrintAndLog("Options:");
e13ccb6b 20 PrintAndLog(" h - This help");
758f5ee3 21 PrintAndLog(" OEM - OEM number / site code");
e13ccb6b 22 PrintAndLog(" FC - facility code");
23 PrintAndLog(" CN - card number");
f4fbfb83 24 PrintAndLog("Examples:");
3a532acf 25 PrintAndLog(" lf hid wiegand 0 101 2001");
26 return 0;
27}
758f5ee3 28int usage_lf_hid_sim(void){
29 PrintAndLog("HID Tag simulator");
30 PrintAndLog("");
31 PrintAndLog("Usage: lf hid sim [h] [ID]");
32 PrintAndLog("Options:");
33 PrintAndLog(" h - This help");
34 PrintAndLog(" ID - HID id");
35 PrintAndLog("Examples:");
36 PrintAndLog(" lf hid sim 224");
37 return 0;
38}
39int usage_lf_hid_clone(void){
40 PrintAndLog("Clone HID to T55x7. Tag must be on antenna. ");
41 PrintAndLog("");
42 PrintAndLog("Usage: lf hid clone [h] [ID] <L>");
43 PrintAndLog("Options:");
44 PrintAndLog(" h - This help");
45 PrintAndLog(" ID - HID id");
46 PrintAndLog(" L - 84bit ID");
47 PrintAndLog("Examples:");
48 PrintAndLog(" lf hid clone 224");
49 PrintAndLog(" lf hid clone 224 L");
50 return 0;
51}
3a532acf 52int usage_lf_hid_brute(void){
e13ccb6b 53 PrintAndLog("Enables bruteforce of HID readers with specified facility code.");
89603cbd 54 PrintAndLog("This is a attack against reader. if cardnumber is given, it starts with it and goes up / down one step");
55 PrintAndLog("if cardnumber is not given, it starts with 1 and goes up to 65535");
3a532acf 56 PrintAndLog("");
89603cbd 57 PrintAndLog("Usage: lf hid brute [h] a <format> f <facility-code> c <cardnumber> d <delay>");
3a532acf 58 PrintAndLog("Options :");
89603cbd 59 PrintAndLog(" h : This help");
60 PrintAndLog(" a <format> : 26|33|34|35|37|40|44|84");
61 PrintAndLog(" f <facility-code> : 8-bit value HID facility code");
62 PrintAndLog(" c <cardnumber> : (optional) cardnumber to start with, max 65535");
63 PrintAndLog(" d <delay> : delay betweens attempts in ms. Default 1000ms");
3a532acf 64 PrintAndLog("");
89603cbd 65 PrintAndLog("Samples:");
66 PrintAndLog(" lf hid brute a 26 f 224");
67 PrintAndLog(" lf hid brute a 26 f 21 d 2000");
68 PrintAndLog(" lf hid brute a 26 f 21 c 200 d 2000");
f4fbfb83 69 return 0;
70}
758f5ee3 71
89603cbd 72static int sendPing(void){
73 UsbCommand ping = {CMD_PING, {1, 2, 3}};
74 SendCommand(&ping);
75 SendCommand(&ping);
76 SendCommand(&ping);
77 clearCommandBuffer();
78 UsbCommand resp;
79 if (WaitForResponseTimeout(CMD_ACK, &resp, 1000))
80 return 0;
81 return 1;
82}
83static bool sendTry(uint8_t fmtlen, uint32_t fc, uint32_t cn, uint32_t delay, uint8_t *bs){
84
85 PrintAndLog("Trying FC: %u; CN: %u", fc, cn);
86
87 calcWiegand( fmtlen, fc, cn, bs);
88
89 uint64_t arg1 = bytebits_to_byte(bs,32);
90 uint64_t arg2 = bytebits_to_byte(bs+32,32);
91 UsbCommand c = {CMD_HID_SIM_TAG, {arg1, arg2, 0}};
92 clearCommandBuffer();
93 SendCommand(&c);
94 msleep(delay);
95 sendPing();
96 return TRUE;
97}
98
3a532acf 99int CmdHIDDemodFSK(const char *Cmd) {
f4fbfb83 100 int findone = ( Cmd[0] == '1' ) ? 1 : 0;
101 UsbCommand c = {CMD_HID_DEMOD_FSK, {findone, 0 , 0}};
102 clearCommandBuffer();
103 SendCommand(&c);
104 return 0;
7fe9b0b7 105}
106
3a532acf 107int CmdHIDSim(const char *Cmd) {
f4fbfb83 108 unsigned int hi = 0, lo = 0;
109 int n = 0, i = 0;
38b20f75 110
758f5ee3 111 uint8_t ctmp = param_getchar(Cmd, 0);
112 if ( strlen(Cmd) == 0 || ctmp == 'H' || ctmp == 'h' ) return usage_lf_hid_sim();
113
f4fbfb83 114 while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
115 hi = (hi << 4) | (lo >> 28);
116 lo = (lo << 4) | (n & 0xf);
117 }
38b20f75 118
f4fbfb83 119 PrintAndLog("Emulating tag with ID %x%16x", hi, lo);
120 PrintAndLog("Press pm3-button to abort simulation");
38b20f75 121
f4fbfb83 122 UsbCommand c = {CMD_HID_SIM_TAG, {hi, lo, 0}};
123 clearCommandBuffer();
124 SendCommand(&c);
125 return 0;
38b20f75 126}
127
3a532acf 128int CmdHIDClone(const char *Cmd) {
758f5ee3 129
8cdf15c2 130 uint32_t hi2 = 0, hi = 0, lo = 0;
f4fbfb83 131 int n = 0, i = 0;
132 UsbCommand c;
38b20f75 133
758f5ee3 134 uint8_t ctmp = param_getchar(Cmd, 0);
135 if ( strlen(Cmd) == 0 || ctmp == 'H' || ctmp == 'h' ) return usage_lf_hid_clone();
136
f4fbfb83 137 if (strchr(Cmd,'l') != 0) {
138 while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
139 hi2 = (hi2 << 4) | (hi >> 28);
140 hi = (hi << 4) | (lo >> 28);
141 lo = (lo << 4) | (n & 0xf);
142 }
38b20f75 143
f4fbfb83 144 PrintAndLog("Cloning tag with long ID %x%08x%08x", hi2, hi, lo);
38b20f75 145
f4fbfb83 146 c.d.asBytes[0] = 1;
147 } else {
148 while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
149 hi = (hi << 4) | (lo >> 28);
150 lo = (lo << 4) | (n & 0xf);
151 }
38b20f75 152
f4fbfb83 153 PrintAndLog("Cloning tag with ID %x%08x", hi, lo);
38b20f75 154
f4fbfb83 155 hi2 = 0;
156 c.d.asBytes[0] = 0;
157 }
ec09b62d 158
f4fbfb83 159 c.cmd = CMD_HID_CLONE_TAG;
160 c.arg[0] = hi2;
161 c.arg[1] = hi;
162 c.arg[2] = lo;
163
164 clearCommandBuffer();
165 SendCommand(&c);
166 return 0;
ec09b62d 167}
758f5ee3 168// struct to handle wiegand
169typedef struct {
170 uint8_t FormatLen;
171 uint8_t SiteCode;
172 uint8_t FacilityCode;
173 uint8_t CardNumber;
174 uint8_t* Wiegand;
175 size_t Wiegand_n;
176 } wiegand_t;
177
fbc2bace 178static void addHIDMarker(uint8_t fmtlen, uint8_t *out) {
a0a61c91 179 switch(fmtlen) {
fbc2bace 180 case 26:{
181 uint8_t len = 37;
182 uint8_t tmp[len];
183 memset(tmp, 0, len);
184 uint8_t idx = 37-fmtlen;
185 memcpy(tmp+idx, out, fmtlen);
186 tmp[idx] = 1; // start sentinel?
187 tmp[0] = 1; // bit indicates that a format smaller than 37 is used
188 memcpy(out, tmp, len);
a0a61c91 189 break;
fbc2bace 190 }
a0a61c91 191 case 34:
192 // set bit format for less than 37 bit format
193 // 5+32= 1
194 //*hi = (1 << 5) | (fc >> 15);
195 break;
196 default:break;
197 }
198}
758f5ee3 199
758f5ee3 200// static void getParity34(uint32_t *hi, uint32_t *lo){
201 // uint32_t result = 0;
202 // int i;
203
204 // // even parity
205 // for (i = 7;i >= 0;i--)
206 // result ^= (*hi >> i) & i;
207 // for (i = 31;i >= 24;i--)
208 // result ^= (*lo >> i) & 1;
209
210 // *hi |= result << 2;
211
212 // // odd parity bit
213 // result = 0;
214 // for (i = 23;i >= 1;i--)
215 // result ^= (*lo >> i) & 1;
216
217 // *lo |= !result;
218// }
758f5ee3 219// static void getParity37H(uint32_t *hi, uint32_t *lo){
220 // uint32_t result = 0;
221 // int i;
222
223 // // even parity
224 // for (i = 4;i >= 0;i--)
225 // result ^= (*hi >> i) & 1;
226 // for (i = 31;i >= 20;i--)
227 // result ^= (*lo >> i) & 1;
228 // *hi |= result << 4;
229
230 // // odd parity
231 // result = 0;
232 // for (i = 19;i >= 1;i--)
233 // result ^= (*lo >> i) & 1;
234 // *lo |= result;
235// }
236
fbc2bace 237//static void calc26(uint16_t fc, uint32_t cardno, uint8_t *out){
a0a61c91 238static void calc26(uint16_t fc, uint32_t cardno, uint8_t *out){
758f5ee3 239 uint8_t wiegand[24];
240 num_to_bytebits(fc, 8, wiegand);
241 num_to_bytebits(cardno, 16, wiegand+8);
242 wiegand_add_parity(out, wiegand, sizeof(wiegand) );
f4fbfb83 243}
fbc2bace 244// static void calc33(uint16_t fc, uint32_t cardno, uint8_t *out){
758f5ee3 245// }
a0a61c91 246static void calc34(uint16_t fc, uint32_t cardno, uint8_t *out){
247 uint8_t wiegand[32];
248 num_to_bytebits(fc, 16, wiegand);
249 num_to_bytebits(cardno, 16, wiegand + 16);
250 wiegand_add_parity(out, wiegand, sizeof(wiegand) );
251}
fbc2bace 252// static void calc35(uint16_t fc, uint32_t cardno, uint8_t *out){
758f5ee3 253 // *lo = ((cardno & 0xFFFFF) << 1) | fc << 21;
254 // *hi = (1 << 5) | ((fc >> 11) & 1);
255// }
a0a61c91 256static void calc37S(uint16_t fc, uint32_t cardno, uint8_t *out){
257 // FC 2 - 17 - 16 bit
258 // cardno 18 - 36 - 19 bit
259 // Even P1 1 - 19
260 // Odd P37 19 - 36
261 uint8_t wiegand[35];
262 num_to_bytebits(fc, 16, wiegand);
263 num_to_bytebits(cardno, 19, wiegand + 16);
264 wiegand_add_parity(out, wiegand, sizeof(wiegand) );
265}
266static void calc37H(uint64_t cardno, uint8_t *out){
267 // SC NONE
268 // cardno 1-35 34 bits
269 // Even Parity 0th bit 1-18
270 // Odd Parity 36th bit 19-35
271 uint8_t wiegand[37];
272 num_to_bytebits( (uint32_t)(cardno >> 32), 2, wiegand);
273 num_to_bytebits( (uint32_t)(cardno >> 0), 32, wiegand + 2);
274 wiegand_add_parity(out, wiegand, sizeof(wiegand) );
275
276 printf("%x %x\n", (uint32_t)(cardno >> 32), (uint32_t)cardno );
277}
fbc2bace 278// static void calc40(uint64_t cardno, uint8_t *out){
758f5ee3 279 // cardno = (cardno & 0xFFFFFFFFFF);
280 // *lo = ((cardno & 0xFFFFFFFF) << 1 );
281 // *hi = (cardno >> 31);
282// }
283
89603cbd 284void calcWiegand(uint8_t fmtlen, uint16_t fc, uint64_t cardno, uint8_t *bits){
a0a61c91 285 uint32_t cn32 = (cardno & 0xFFFFFFFF);
286 switch ( fmtlen ) {
fbc2bace 287 case 26: calc26(fc, cn32, bits); break;
288 // case 33 : calc33(fc, cn32, bits); break;
289 case 34: calc34(fc, cn32, bits); break;
290 // case 35 : calc35(fc, cn32, bits); break;
291 case 37: calc37S(fc, cn32, bits); break;
292 case 38: calc37H(cardno, bits); break;
293 // case 40 : calc40(cardno, bits); break;
758f5ee3 294 // case 44 : { break; }
295 // case 84 : { break; }
a0a61c91 296 default: break;
297 }
3a532acf 298}
299
300int CmdHIDWiegand(const char *Cmd) {
758f5ee3 301 uint32_t oem = 0, fc = 0;
3a532acf 302 uint64_t cardnum = 0;
a0a61c91 303 uint64_t blocks = 0, wiegand = 0;
758f5ee3 304
305 uint8_t bits[96];
306 uint8_t *bs = bits;
307 memset(bs, 0, sizeof(bits));
308
3a532acf 309 uint8_t ctmp = param_getchar(Cmd, 0);
e1ad67ea 310 if ( strlen(Cmd) == 0 || strlen(Cmd) < 3 || ctmp == 'H' || ctmp == 'h' ) return usage_lf_hid_wiegand();
3a532acf 311
312 oem = param_get8(Cmd, 0);
313 fc = param_get32ex(Cmd, 1, 0, 10);
314 cardnum = param_get64ex(Cmd, 2, 0, 10);
315
a0a61c91 316 uint8_t fmtlen[] = {26,33,34,35,37,38,40};
758f5ee3 317
a0a61c91 318 PrintAndLog("HID | OEM | FC | CN | Wiegand | HID Formatted");
319 PrintAndLog("----+-----+------+---------+-----------+--------------------");
320 for (uint8_t i = 0; i < sizeof(fmtlen); i++){
321 memset(bits, 0x00, sizeof(bits));
322 calcWiegand( fmtlen[i], fc, cardnum, bs);
fbc2bace 323 printf("ice:: %s", sprint_bin(bs, fmtlen[i]));
a0a61c91 324 wiegand = (uint64_t)bytebits_to_byte(bs, 32) << 32 | bytebits_to_byte(bs+32, 32);
fbc2bace 325
326 addHIDMarker(fmtlen[i], bs);
327 printf("ice:: %s", sprint_bin(bs, 37));
a0a61c91 328 blocks = (uint64_t)bytebits_to_byte(bs, 32) << 32 | bytebits_to_byte(bs+32, 32);
329 uint8_t shifts = 64-fmtlen[i];
330 wiegand >>= shifts;
331
332 PrintAndLog(" %u | %03u | %03u | %llu | %llX | %llX",
333 fmtlen[i],
e92948c6 334 oem,
758f5ee3 335 fc,
336 cardnum,
a0a61c91 337 wiegand,
338 blocks
758f5ee3 339 );
3a532acf 340 }
e92948c6 341 PrintAndLog("----+-----+-----+-------+-----------+--------------------");
3a532acf 342 return 0;
343}
344
345int CmdHIDBrute(const char *Cmd){
346
89603cbd 347 bool errors = false;
348 uint32_t fc = 0, cn = 0, delay = 1000;
349 uint8_t fmtlen = 0;
758f5ee3 350 uint8_t bits[96];
351 uint8_t *bs = bits;
352 memset(bs, 0, sizeof(bits));
89603cbd 353 uint8_t cmdp = 0;
354
355 while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {
356 switch(param_getchar(Cmd, cmdp)) {
357 case 'h':
358 case 'H':
359 return usage_lf_hid_brute();
360 case 'f':
361 case 'F':
362 fc = param_get32ex(Cmd ,cmdp+1, 0, 10);
363 if ( !fc )
364 errors = true;
365 cmdp += 2;
366 break;
367 case 'd':
368 case 'D':
369 // delay between attemps, defaults to 1000ms.
370 delay = param_get32ex(Cmd, cmdp+1, 1000, 10);
371 cmdp += 2;
372 break;
373 case 'c':
374 case 'C':
375 cn = param_get32ex(Cmd, cmdp+1, 0, 10);
376 // truncate cardnumber.
377 cn &= 0xFFFF;
378 cmdp += 2;
379 break;
380 case 'a':
381 case 'A':
382 fmtlen = param_get8(Cmd, cmdp+1);
383 cmdp += 2;
7aa24806 384 bool is_ftm_ok = FALSE;
89603cbd 385 uint8_t ftms[] = {26,33,34,35,37};
386 for ( uint8_t i = 0; i < sizeof(ftms); i++){
387 if ( ftms[i] == fmtlen ) {
7aa24806 388 is_ftm_ok = TRUE;
89603cbd 389 }
390 }
7aa24806 391 // negated
392 errors = !is_ftm_ok;
89603cbd 393 break;
394 default:
395 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
396 errors = true;
397 break;
3a532acf 398 }
399 }
89603cbd 400 if ( fc == 0 ) errors = true;
401 if ( errors ) return usage_lf_hid_brute();
3a532acf 402
e13ccb6b 403 PrintAndLog("Brute-forcing HID reader");
3a532acf 404 PrintAndLog("Press pm3-button to abort simulation or run another command");
89603cbd 405
406 uint16_t up = cn;
407 uint16_t down = cn;
408
409 for (;;){
410
411 if ( offline ) {
412 printf("Device offline\n");
413 return 2;
414 }
415
3a532acf 416 if (ukbhit()) {
417 PrintAndLog("aborted via keyboard!");
89603cbd 418 return sendPing();
3a532acf 419 }
3a532acf 420
89603cbd 421 // Do one up
422 if ( up < 0xFFFF )
423 if ( !sendTry(fmtlen, fc, up++, delay, bs)) return 1;
424
425 // Do one down (if cardnumber is given)
426 if ( cn > 1 )
427 if ( down > 1 )
428 if ( !sendTry(fmtlen, fc, --down, delay, bs)) return 1;
3a532acf 429 }
f4fbfb83 430 return 0;
431}
432
433static command_t CommandTable[] = {
e13ccb6b 434 {"help", CmdHelp, 1, "This help"},
89603cbd 435 {"fskdemod",CmdHIDDemodFSK, 0, "Realtime HID FSK demodulator"},
436 {"sim", CmdHIDSim, 0, "HID tag simulator"},
437 {"clone", CmdHIDClone, 0, "Clone HID to T55x7"},
8cdf15c2 438 {"wiegand", CmdHIDWiegand, 1, "Convert facility code/card number to Wiegand code"},
89603cbd 439 {"brute", CmdHIDBrute, 0, "Bruteforce card number against reader"},
f4fbfb83 440 {NULL, NULL, 0, NULL}
7fe9b0b7 441};
442
f4fbfb83 443int CmdLFHID(const char *Cmd) {
4c36581b 444 clearCommandBuffer();
f4fbfb83 445 CmdsParse(CommandTable, Cmd);
446 return 0;
7fe9b0b7 447}
448
f4fbfb83 449int CmdHelp(const char *Cmd) {
450 CmdsHelp(CommandTable);
451 return 0;
7fe9b0b7 452}
Impressum, Datenschutz