]> git.zerfleddert.de Git - proxmark3-svn/blame - client/cmdlfguard.c
ADD: changed the annotation for 14b, it now shows WUPB/REQB and number of slots we...
[proxmark3-svn] / client / cmdlfguard.c
CommitLineData
50564be0 1//-----------------------------------------------------------------------------
2//
3// This code is licensed to you under the terms of the GNU GPL, version 2 or,
4// at your option, any later version. See the LICENSE.txt file for the text of
5// the license.
6//-----------------------------------------------------------------------------
7// Low frequency Farpoint / Pyramid tag commands
8//-----------------------------------------------------------------------------
9#include <string.h>
10#include <inttypes.h>
11#include "cmdlfguard.h"
12static int CmdHelp(const char *Cmd);
13
14int usage_lf_guard_clone(void){
15 PrintAndLog("clone a Guardall tag to a T55x7 tag.");
16 PrintAndLog("The facility-code is 8-bit and the card number is 16-bit. Larger values are truncated. ");
17 PrintAndLog("Currently work only on 26bit");
18 PrintAndLog("");
19 PrintAndLog("Usage: lf guard clone <Facility-Code> <Card-Number>");
20 PrintAndLog("Options :");
21 PrintAndLog(" <Facility-Code> : 8-bit value facility code");
22 PrintAndLog(" <Card Number> : 16-bit value card number");
23 PrintAndLog("");
24 PrintAndLog("Sample : lf guard clone 123 11223");
25 return 0;
26}
27
28int usage_lf_guard_sim(void) {
29 PrintAndLog("Enables simulation of Guardall card with specified card number.");
30 PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
31 PrintAndLog("The facility-code is 8-bit and the card number is 16-bit. Larger values are truncated.");
32 PrintAndLog("Currently work only on 26bit");
33 PrintAndLog("");
34 PrintAndLog("Usage: lf guard sim <Card-Number>");
35 PrintAndLog("Options :");
36 PrintAndLog(" <Facility-Code> : 8-bit value facility code");
37 PrintAndLog(" <Card Number> : 16-bit value card number");
38 PrintAndLog("");
39 PrintAndLog("Sample : lf guard sim 123 11223");
40 return 0;
41}
42
43
44// Works for 26bits.
45int GetGuardBits(uint32_t fc, uint32_t cn, uint8_t *guardBits) {
46
47 // Intializes random number generator
48 time_t t;
49 srand((unsigned) time(&t));
0d2c5909 50 //uint8_t xorKey = rand() % 0xFF;
c728b2b4 51 uint8_t xorKey = 0x66;
0d2c5909 52 uint8_t i;
50564be0 53
50564be0 54
0d2c5909 55 uint8_t pre[96];
56 memset(pre, 0x00, sizeof(pre));
50564be0 57
50564be0 58 // Get 26 wiegand from FacilityCode, CardNumber
59 uint8_t wiegand[24];
60 memset(wiegand, 0x00, sizeof(wiegand));
61 num_to_bytebits(fc, 8, wiegand);
62 num_to_bytebits(cn, 16, wiegand+8);
63
64 // add wiegand parity bits (dest, source, len)
0d2c5909 65 wiegand_add_parity(pre, wiegand, 24);
50564be0 66
0d2c5909 67 // lets start. 12bytes of data to be produced.
68 uint8_t rawbytes[12];
69 memset(rawbytes, 0x00, sizeof(rawbytes));
70
71 // xor key
72 rawbytes[0] = xorKey;
73
74 // add format length (decimal)
75 // len | hex | bin
76 // 26 | 1A | 0001 1010
77 rawbytes[1] = (26 << 2);
78 // 36 | 24 | 0010 0100
79 //rawbytes[1] = (36 << 2);
80 // 40 | 28 | 0010 1000
81 //rawbytes[1] = (40 << 2);
82
83 // 2bit checksum, unknown today,
84 // these two bits are the last ones of rawbyte[1], hence the LSHIFT above.
85 rawbytes[2] = 1;
86 rawbytes[3] = 0;
50564be0 87
0d2c5909 88 // add wiegand to rawbytes
89 for (i = 0; i < 4; ++i)
90 rawbytes[i+4] = bytebits_to_byte( pre + (i*8), 8);
50564be0 91
0d2c5909 92 if (g_debugMode) printf(" WIE | %s\n", sprint_hex(rawbytes, sizeof(rawbytes)));
50564be0 93
0d2c5909 94 // XOR (only works on wiegand stuff)
95 for (i = 1; i < 12; ++i)
96 rawbytes[i] ^= xorKey ;
97
98 if (g_debugMode) printf(" XOR | %s \n", sprint_hex(rawbytes, sizeof(rawbytes)));
99
100 // convert rawbytes to bits in pre
101 for (i = 0; i < 12; ++i)
102 num_to_bytebitsLSBF( rawbytes[i], 8, pre + (i*8));
103
104 if (g_debugMode) printf("\n Raw | %s \n", sprint_hex(rawbytes, sizeof(rawbytes)));
105 if (g_debugMode) printf(" Raw | %s\n", sprint_bin(pre, 64) );
106
107 // add spacer bit 0 every 4 bits, starting with index 0,
07291f87 108 // 12 bytes, 24 nibbles. 24+1 extra bites. 3bytes. ie 9bytes | 1byte xorkey, 8bytes rawdata (64bits, should be enough for a 40bit wiegand)
0d2c5909 109 addParity(pre, guardBits+6, 64, 5, 3);
110
111 // preamble
112 guardBits[0] = 1;
113 guardBits[1] = 1;
114 guardBits[2] = 1;
115 guardBits[3] = 1;
116 guardBits[4] = 1;
117 guardBits[5] = 0;
0d2c5909 118
119 if (g_debugMode) printf(" FIN | %s\n", sprint_bin(guardBits, 96) );
50564be0 120 return 1;
121}
122
123int CmdGuardRead(const char *Cmd) {
124 CmdLFRead("s");
125 getSamples("30000",false);
126 return CmdG_Prox_II_Demod("");
127}
128
129int CmdGuardClone(const char *Cmd) {
130
131 char cmdp = param_getchar(Cmd, 0);
132 if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_guard_clone();
133
134 uint32_t facilitycode=0, cardnumber=0, fc = 0, cn = 0;
135 uint8_t i;
136 uint8_t bs[96];
137 memset(bs, 0x00, sizeof(bs));
138
139 //GuardProxII - compat mode, ASK/Biphase, data rate 64, 3 data blocks
140 uint32_t blocks[5] = {T55x7_MODULATION_BIPHASE | T55x7_BITRATE_RF_64 | 3<<T55x7_MAXBLOCK_SHIFT, 0, 0, 0, 0};
141
142// if (param_getchar(Cmd, 3) == 'Q' || param_getchar(Cmd, 3) == 'q')
143// blocks[0] = T5555_MODULATION_FSK2 | 50<<T5555_BITRATE_SHIFT | 4<<T5555_MAXBLOCK_SHIFT;
144
145 if (sscanf(Cmd, "%u %u", &fc, &cn ) != 2) return usage_lf_guard_clone();
146
147 facilitycode = (fc & 0x000000FF);
148 cardnumber = (cn & 0x0000FFFF);
149
150 if ( !GetGuardBits(facilitycode, cardnumber, bs)) {
151 PrintAndLog("Error with tag bitstream generation.");
152 return 1;
153 }
154
155 blocks[1] = bytebits_to_byte(bs,32);
156 blocks[2] = bytebits_to_byte(bs+32,32);
157 blocks[3] = bytebits_to_byte(bs+64,32);
158
159 PrintAndLog("Preparing to clone Guardall to T55x7 with Facility Code: %u, Card Number: %u", facilitycode, cardnumber);
160 PrintAndLog("Blk | Data ");
161 PrintAndLog("----+------------");
162 for ( i = 0; i<4; ++i )
163 PrintAndLog(" %02d | %08x", i, blocks[i]);
164
0d2c5909 165 UsbCommand resp;
166 UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}};
167
168 for ( i = 0; i<4; ++i ) {
169 c.arg[0] = blocks[i];
170 c.arg[1] = i;
171 clearCommandBuffer();
172 SendCommand(&c);
173 if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){
174 PrintAndLog("Error occurred, device did not respond during write operation.");
175 return -1;
176 }
177 }
50564be0 178 return 0;
179}
180
181int CmdGuardSim(const char *Cmd) {
182
183 char cmdp = param_getchar(Cmd, 0);
184 if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_guard_sim();
185
186 uint32_t facilitycode = 0, cardnumber = 0, fc = 0, cn = 0;
07291f87 187 uint8_t clock = 64, encoding = 2, separator = 0, invert = 0;
50564be0 188
189 uint8_t bs[96];
07291f87 190 memset(bs, 0x00, sizeof(bs));
50564be0 191
50564be0 192 if (sscanf(Cmd, "%u %u", &fc, &cn ) != 2) return usage_lf_guard_sim();
193
194 facilitycode = (fc & 0x000000FF);
195 cardnumber = (cn & 0x0000FFFF);
196
197 if ( !GetGuardBits(facilitycode, cardnumber, bs)) {
198 PrintAndLog("Error with tag bitstream generation.");
199 return 1;
200 }
201
202 PrintAndLog("Simulating Guardall - Facility Code: %u, CardNumber: %u", facilitycode, cardnumber );
07291f87 203
204 // Guard uses: clk: 64, invert: 0, encoding: 2 (ASK Biphase)
205 uint64_t arg1, arg2;
206 arg1 = (clock << 8) | encoding;
207 arg2 = (invert << 8) | separator;
208
209 uint8_t rawbytes[12];
210 size_t size = sizeof(rawbytes);
211 for (uint8_t i=0; i < size; ++i){
212 rawbytes[i] = bytebits_to_byte( bs + (i*8), 8);
213 }
214
50564be0 215 UsbCommand c = {CMD_ASK_SIM_TAG, {arg1, arg2, size}};
07291f87 216 memcpy(c.d.asBytes, rawbytes, size );
50564be0 217 clearCommandBuffer();
218 SendCommand(&c);
219 return 0;
220}
221
222static command_t CommandTable[] = {
223 {"help", CmdHelp, 1, "This help"},
224 {"read", CmdGuardRead, 0, "Attempt to read and extract tag data"},
0d2c5909 225 {"clone", CmdGuardClone, 0, "<Facility-Code> <Card Number> clone Guardall tag"},
07291f87 226 {"sim", CmdGuardSim, 0, "<Facility-Code> <Card Number> simulate Guardall tag"},
50564be0 227 {NULL, NULL, 0, NULL}
228};
229
230int CmdLFGuard(const char *Cmd) {
231 clearCommandBuffer();
232 CmdsParse(CommandTable, Cmd);
233 return 0;
234}
235
236int CmdHelp(const char *Cmd) {
237 CmdsHelp(CommandTable);
238 return 0;
239}
Impressum, Datenschutz