]> git.zerfleddert.de Git - proxmark3-svn/blame - client/cmdlfguard.c
CHG: 'lf search' changed output to be visible when debugging for IO prox
[proxmark3-svn] / client / cmdlfguard.c
CommitLineData
50564be0 1//-----------------------------------------------------------------------------
2//
3// This code is licensed to you under the terms of the GNU GPL, version 2 or,
4// at your option, any later version. See the LICENSE.txt file for the text of
5// the license.
6//-----------------------------------------------------------------------------
7// Low frequency Farpoint / Pyramid tag commands
8//-----------------------------------------------------------------------------
9#include <string.h>
10#include <inttypes.h>
11#include "cmdlfguard.h"
12static int CmdHelp(const char *Cmd);
13
14int usage_lf_guard_clone(void){
15 PrintAndLog("clone a Guardall tag to a T55x7 tag.");
16 PrintAndLog("The facility-code is 8-bit and the card number is 16-bit. Larger values are truncated. ");
17 PrintAndLog("Currently work only on 26bit");
18 PrintAndLog("");
19 PrintAndLog("Usage: lf guard clone <Facility-Code> <Card-Number>");
20 PrintAndLog("Options :");
21 PrintAndLog(" <Facility-Code> : 8-bit value facility code");
22 PrintAndLog(" <Card Number> : 16-bit value card number");
23 PrintAndLog("");
24 PrintAndLog("Sample : lf guard clone 123 11223");
25 return 0;
26}
27
28int usage_lf_guard_sim(void) {
29 PrintAndLog("Enables simulation of Guardall card with specified card number.");
30 PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
31 PrintAndLog("The facility-code is 8-bit and the card number is 16-bit. Larger values are truncated.");
32 PrintAndLog("Currently work only on 26bit");
33 PrintAndLog("");
34 PrintAndLog("Usage: lf guard sim <Card-Number>");
35 PrintAndLog("Options :");
36 PrintAndLog(" <Facility-Code> : 8-bit value facility code");
37 PrintAndLog(" <Card Number> : 16-bit value card number");
38 PrintAndLog("");
39 PrintAndLog("Sample : lf guard sim 123 11223");
40 return 0;
41}
42
43
44// Works for 26bits.
45int GetGuardBits(uint32_t fc, uint32_t cn, uint8_t *guardBits) {
46
47 // Intializes random number generator
48 time_t t;
49 srand((unsigned) time(&t));
0d2c5909 50 //uint8_t xorKey = rand() % 0xFF;
c728b2b4 51 uint8_t xorKey = 0x66;
0d2c5909 52 uint8_t i;
50564be0 53
50564be0 54
0d2c5909 55 uint8_t pre[96];
56 memset(pre, 0x00, sizeof(pre));
50564be0 57
50564be0 58 // Get 26 wiegand from FacilityCode, CardNumber
59 uint8_t wiegand[24];
60 memset(wiegand, 0x00, sizeof(wiegand));
61 num_to_bytebits(fc, 8, wiegand);
62 num_to_bytebits(cn, 16, wiegand+8);
63
64 // add wiegand parity bits (dest, source, len)
0d2c5909 65 wiegand_add_parity(pre, wiegand, 24);
50564be0 66
0d2c5909 67 // lets start. 12bytes of data to be produced.
68 uint8_t rawbytes[12];
69 memset(rawbytes, 0x00, sizeof(rawbytes));
70
71 // xor key
72 rawbytes[0] = xorKey;
73
74 // add format length (decimal)
75 // len | hex | bin
76 // 26 | 1A | 0001 1010
77 rawbytes[1] = (26 << 2);
78 // 36 | 24 | 0010 0100
79 //rawbytes[1] = (36 << 2);
80 // 40 | 28 | 0010 1000
81 //rawbytes[1] = (40 << 2);
82
83 // 2bit checksum, unknown today,
84 // these two bits are the last ones of rawbyte[1], hence the LSHIFT above.
85 rawbytes[2] = 1;
86 rawbytes[3] = 0;
50564be0 87
0d2c5909 88 // add wiegand to rawbytes
89 for (i = 0; i < 4; ++i)
90 rawbytes[i+4] = bytebits_to_byte( pre + (i*8), 8);
50564be0 91
0d2c5909 92 if (g_debugMode) printf(" WIE | %s\n", sprint_hex(rawbytes, sizeof(rawbytes)));
50564be0 93
0d2c5909 94 // XOR (only works on wiegand stuff)
95 for (i = 1; i < 12; ++i)
96 rawbytes[i] ^= xorKey ;
97
98 if (g_debugMode) printf(" XOR | %s \n", sprint_hex(rawbytes, sizeof(rawbytes)));
99
100 // convert rawbytes to bits in pre
101 for (i = 0; i < 12; ++i)
102 num_to_bytebitsLSBF( rawbytes[i], 8, pre + (i*8));
103
104 if (g_debugMode) printf("\n Raw | %s \n", sprint_hex(rawbytes, sizeof(rawbytes)));
105 if (g_debugMode) printf(" Raw | %s\n", sprint_bin(pre, 64) );
106
107 // add spacer bit 0 every 4 bits, starting with index 0,
07291f87 108 // 12 bytes, 24 nibbles. 24+1 extra bites. 3bytes. ie 9bytes | 1byte xorkey, 8bytes rawdata (64bits, should be enough for a 40bit wiegand)
0d2c5909 109 addParity(pre, guardBits+6, 64, 5, 3);
110
111 // preamble
112 guardBits[0] = 1;
113 guardBits[1] = 1;
114 guardBits[2] = 1;
115 guardBits[3] = 1;
116 guardBits[4] = 1;
117 guardBits[5] = 0;
0d2c5909 118
119 if (g_debugMode) printf(" FIN | %s\n", sprint_bin(guardBits, 96) );
50564be0 120 return 1;
121}
122
123int CmdGuardRead(const char *Cmd) {
124 CmdLFRead("s");
125 getSamples("30000",false);
126 return CmdG_Prox_II_Demod("");
127}
128
129int CmdGuardClone(const char *Cmd) {
130
131 char cmdp = param_getchar(Cmd, 0);
132 if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_guard_clone();
133
134 uint32_t facilitycode=0, cardnumber=0, fc = 0, cn = 0;
135 uint8_t i;
136 uint8_t bs[96];
137 memset(bs, 0x00, sizeof(bs));
138
139 //GuardProxII - compat mode, ASK/Biphase, data rate 64, 3 data blocks
140 uint32_t blocks[5] = {T55x7_MODULATION_BIPHASE | T55x7_BITRATE_RF_64 | 3<<T55x7_MAXBLOCK_SHIFT, 0, 0, 0, 0};
141
142// if (param_getchar(Cmd, 3) == 'Q' || param_getchar(Cmd, 3) == 'q')
890ae3dd 143 //t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
50564be0 144// blocks[0] = T5555_MODULATION_FSK2 | 50<<T5555_BITRATE_SHIFT | 4<<T5555_MAXBLOCK_SHIFT;
145
146 if (sscanf(Cmd, "%u %u", &fc, &cn ) != 2) return usage_lf_guard_clone();
147
148 facilitycode = (fc & 0x000000FF);
149 cardnumber = (cn & 0x0000FFFF);
150
151 if ( !GetGuardBits(facilitycode, cardnumber, bs)) {
152 PrintAndLog("Error with tag bitstream generation.");
153 return 1;
154 }
155
156 blocks[1] = bytebits_to_byte(bs,32);
157 blocks[2] = bytebits_to_byte(bs+32,32);
158 blocks[3] = bytebits_to_byte(bs+64,32);
159
160 PrintAndLog("Preparing to clone Guardall to T55x7 with Facility Code: %u, Card Number: %u", facilitycode, cardnumber);
161 PrintAndLog("Blk | Data ");
162 PrintAndLog("----+------------");
163 for ( i = 0; i<4; ++i )
164 PrintAndLog(" %02d | %08x", i, blocks[i]);
165
0d2c5909 166 UsbCommand resp;
167 UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}};
168
169 for ( i = 0; i<4; ++i ) {
170 c.arg[0] = blocks[i];
171 c.arg[1] = i;
172 clearCommandBuffer();
173 SendCommand(&c);
174 if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){
175 PrintAndLog("Error occurred, device did not respond during write operation.");
176 return -1;
177 }
178 }
50564be0 179 return 0;
180}
181
182int CmdGuardSim(const char *Cmd) {
183
184 char cmdp = param_getchar(Cmd, 0);
185 if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_guard_sim();
186
187 uint32_t facilitycode = 0, cardnumber = 0, fc = 0, cn = 0;
07291f87 188 uint8_t clock = 64, encoding = 2, separator = 0, invert = 0;
50564be0 189
190 uint8_t bs[96];
07291f87 191 memset(bs, 0x00, sizeof(bs));
50564be0 192
50564be0 193 if (sscanf(Cmd, "%u %u", &fc, &cn ) != 2) return usage_lf_guard_sim();
194
195 facilitycode = (fc & 0x000000FF);
196 cardnumber = (cn & 0x0000FFFF);
197
198 if ( !GetGuardBits(facilitycode, cardnumber, bs)) {
199 PrintAndLog("Error with tag bitstream generation.");
200 return 1;
201 }
202
203 PrintAndLog("Simulating Guardall - Facility Code: %u, CardNumber: %u", facilitycode, cardnumber );
07291f87 204
205 // Guard uses: clk: 64, invert: 0, encoding: 2 (ASK Biphase)
206 uint64_t arg1, arg2;
207 arg1 = (clock << 8) | encoding;
208 arg2 = (invert << 8) | separator;
209
210 uint8_t rawbytes[12];
211 size_t size = sizeof(rawbytes);
212 for (uint8_t i=0; i < size; ++i){
213 rawbytes[i] = bytebits_to_byte( bs + (i*8), 8);
214 }
215
50564be0 216 UsbCommand c = {CMD_ASK_SIM_TAG, {arg1, arg2, size}};
07291f87 217 memcpy(c.d.asBytes, rawbytes, size );
50564be0 218 clearCommandBuffer();
219 SendCommand(&c);
220 return 0;
221}
222
223static command_t CommandTable[] = {
224 {"help", CmdHelp, 1, "This help"},
225 {"read", CmdGuardRead, 0, "Attempt to read and extract tag data"},
0d2c5909 226 {"clone", CmdGuardClone, 0, "<Facility-Code> <Card Number> clone Guardall tag"},
07291f87 227 {"sim", CmdGuardSim, 0, "<Facility-Code> <Card Number> simulate Guardall tag"},
50564be0 228 {NULL, NULL, 0, NULL}
229};
230
231int CmdLFGuard(const char *Cmd) {
232 clearCommandBuffer();
233 CmdsParse(CommandTable, Cmd);
234 return 0;
235}
236
237int CmdHelp(const char *Cmd) {
238 CmdsHelp(CommandTable);
239 return 0;
240}
Impressum, Datenschutz