]> git.zerfleddert.de Git - proxmark3-svn/blame - client/cmdlfnedap.c
FIX: T5555/Q5 datarate when used in "Q" parameter, consequential fix in lf commands...
[proxmark3-svn] / client / cmdlfnedap.c
CommitLineData
56bbb25a 1//-----------------------------------------------------------------------------
2//
3// This code is licensed to you under the terms of the GNU GPL, version 2 or,
4// at your option, any later version. See the LICENSE.txt file for the text of
5// the license.
6//-----------------------------------------------------------------------------
7// Low frequency NEDAP tag commands
8//-----------------------------------------------------------------------------
9#include <string.h>
10#include <inttypes.h>
11#include "cmdlfnedap.h"
12static int CmdHelp(const char *Cmd);
13
14int usage_lf_nedap_clone(void){
15 PrintAndLog("clone a NEDAP tag to a T55x7 tag.");
16 PrintAndLog("");
8ae9b358 17 PrintAndLog("Usage: lf nedap clone [h] <Card-Number>");
18 PrintAndLog("Options:");
19 PrintAndLog(" h : This help");
20 PrintAndLog(" <Card Number> : 24-bit value card number");
21// PrintAndLog(" Q5 : optional - clone to Q5 (T5555) instead of T55x7 chip");
56bbb25a 22 PrintAndLog("");
8ae9b358 23 PrintAndLog("Sample: lf nedap clone 112233");
56bbb25a 24 return 0;
25}
26
27int usage_lf_nedap_sim(void) {
28 PrintAndLog("Enables simulation of NEDAP card with specified card number.");
29 PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
30 PrintAndLog("");
8ae9b358 31 PrintAndLog("Usage: lf nedap sim [h] <Card-Number>");
32 PrintAndLog("Options:");
33 PrintAndLog(" h : This help");
34 PrintAndLog(" <Card Number> : 24-bit value card number");
56bbb25a 35 PrintAndLog("");
8ae9b358 36 PrintAndLog("Sample: lf nedap sim 112233");
56bbb25a 37 return 0;
38}
39
40int GetNedapBits(uint32_t cn, uint8_t *nedapBits) {
41
42 uint8_t pre[128];
43 memset(pre, 0x00, sizeof(pre));
44
45 // preamble 1111 1111 10 = 0XF8
46 num_to_bytebits(0xF8, 10, pre);
47
48 // fixed tagtype code? 0010 1101 = 0x2D
49 num_to_bytebits(0x2D, 8, pre+10);
50
51 // 46 encrypted bits - UNKNOWN ALGO
52 // -- 16 bits checksum. Should be 4x4 checksum, based on UID and 2 constant values.
53 // -- 30 bits undocumented?
54 num_to_bytebits(cn, 46, pre+18);
55
56 //----from this part, the UID in clear text, with a 1bit ZERO as separator between bytes.
57 pre[64] = 0;
58
2d1885f1 59 // cardnumber (uid)
56bbb25a 60 num_to_bytebits(cn, 24, pre+64);
61
62 pre[73] = 0;
63 pre[82] = 0;
64 pre[91] = 0;
65 pre[100] = 0;
66 pre[109] = 0;
67 pre[118] = 0;
68
69 // add paritybits (bitsource, dest, sourcelen, paritylen, parityType (odd, even,)
70 addParity(pre+64, pre+64, 128, 8, 1);
c71f4da9 71
56bbb25a 72//1111111110001011010000010110100011001001000010110101001101011001000110011010010000000000100001110001001000000001000101011100111
73 return 1;
74}
2d1885f1 75/*
76 - UID: 001630
77 - i: 4071
78 - Checksum2 BE21
79*/
c71f4da9 80//GetParity( uint8_t *bits, uint8_t type, int length)
81
2d1885f1 82//NEDAP demod - ASK/Biphase (or Diphase), RF/64 with preamble of 1111111110 (always a 128 bit data stream)
56bbb25a 83//print NEDAP Prox ID, encoding, encrypted ID,
c71f4da9 84
85int CmdLFNedapDemod(const char *Cmd) {
56bbb25a 86 //raw ask demod no start bit finding just get binary from wave
c71f4da9 87 if (!ASKbiphaseDemod("0 64 0 0", FALSE)) {
bb73c58d 88 if (g_debugMode) PrintAndLog("DEBUG: Error - Nedap ASKbiphaseDemod failed");
96faed21 89 return 0;
90 }
6c283951 91 size_t size = DemodBufferLen;
c71f4da9 92 int idx = NedapDemod(DemodBuffer, &size);
56bbb25a 93 if (idx < 0){
94 if (g_debugMode){
2d1885f1 95 // if (idx == -5)
96 // PrintAndLog("DEBUG: Error - not enough samples");
97 // else if (idx == -1)
98 // PrintAndLog("DEBUG: Error - only noise found");
99 // else if (idx == -2)
100 // PrintAndLog("DEBUG: Error - problem during ASK/Biphase demod");
101 if (idx == -3)
bb73c58d 102 PrintAndLog("DEBUG: Error - Nedap Size not correct: %d", size);
56bbb25a 103 else if (idx == -4)
bb73c58d 104 PrintAndLog("DEBUG: Error - Nedap preamble not found");
56bbb25a 105 else
bb73c58d 106 PrintAndLog("DEBUG: Error - Nedap idx: %d",idx);
56bbb25a 107 }
108 return 0;
109 }
110
2d1885f1 111/* Index map E E
112 preamble enc tag type encrypted uid P d 33 d 90 d 04 d 71 d 40 d 45 d E7 P
113 1111111110 00101101000001011010001100100100001011010100110101100 1 0 00110011 0 10010000 0 00000100 0 01110001 0 01000000 0 01000101 0 11100111 1
532bcd71 114 uid2 uid1 uid0 I I R R
2d1885f1 115 1111111110 00101101000001011010001100100100001011010100110101100 1
116
117 0 00110011
118 0 10010000
119 0 00000100
120 0 01110001
121 0 01000000
122 0 01000101
123 0 11100111
124 1
125
56bbb25a 126 Tag ID is 049033
127 I = Identical on all tags
128 R = Random ?
129 UID2, UID1, UID0 == card number
532bcd71 130
56bbb25a 131*/
56bbb25a 132 //get raw ID before removing parities
2d1885f1 133 uint32_t raw[4] = {0,0,0,0};
134 raw[0] = bytebits_to_byte(DemodBuffer+idx+96,32);
135 raw[1] = bytebits_to_byte(DemodBuffer+idx+64,32);
136 raw[2] = bytebits_to_byte(DemodBuffer+idx+32,32);
137 raw[3] = bytebits_to_byte(DemodBuffer+idx,32);
c71f4da9 138 setDemodBuf(DemodBuffer,128,idx);
56bbb25a 139
2d1885f1 140 uint8_t firstParity = GetParity( DemodBuffer, EVEN, 63);
141 if ( firstParity != DemodBuffer[63] ) {
bb73c58d 142 PrintAndLog("DEBUG: Error - Nedap 1st 64bit parity check failed: %d|%d ", DemodBuffer[63], firstParity);
6c283951 143 return 0;
532bcd71 144 }
145
2d1885f1 146 uint8_t secondParity = GetParity( DemodBuffer+64, EVEN, 63);
147 if ( secondParity != DemodBuffer[127] ) {
bb73c58d 148 PrintAndLog("DEBUG: Error - Nedap 2st 64bit parity check failed: %d|%d ", DemodBuffer[127], secondParity);
6c283951 149 return 0;
2d1885f1 150 }
532bcd71 151
56bbb25a 152 // ok valid card found!
2d1885f1 153 uint32_t uid = 0;
154 uid = bytebits_to_byte(DemodBuffer+65, 8);
155 uid |= bytebits_to_byte(DemodBuffer+74, 8) << 8;
156 uid |= bytebits_to_byte(DemodBuffer+83, 8) << 16;
157
158 uint16_t two = 0;
159 two = bytebits_to_byte(DemodBuffer+92, 8);
160 two |= bytebits_to_byte(DemodBuffer+101, 8) << 8;
56bbb25a 161
2d1885f1 162 uint16_t chksum2 = 0;
163 chksum2 = bytebits_to_byte(DemodBuffer+110, 8);
164 chksum2 |= bytebits_to_byte(DemodBuffer+119, 8) << 8;
165
166 PrintAndLog("NEDAP ID Found - Raw: %08x%08x%08x%08x", raw[3], raw[2], raw[1], raw[0]);
167 PrintAndLog(" - UID: %06X", uid);
168 PrintAndLog(" - i: %04X", two);
169 PrintAndLog(" - Checksum2 %04X", chksum2);
170
56bbb25a 171 if (g_debugMode){
172 PrintAndLog("DEBUG: idx: %d, Len: %d, Printing Demod Buffer:", idx, 128);
173 printDemodBuff();
2d1885f1 174 PrintAndLog("BIN:\n%s", sprint_bin_break( DemodBuffer, 128, 64) );
56bbb25a 175 }
c71f4da9 176
56bbb25a 177 return 1;
178}
c71f4da9 179/*
2d1885f1 180configuration
181lf t55xx wr b 0 d 00170082
182
1831) uid 049033
c71f4da9 184lf t55 wr b 1 d FF8B4168
185lf t55 wr b 2 d C90B5359
186lf t55 wr b 3 d 19A40087
187lf t55 wr b 4 d 120115CF
56bbb25a 188
2d1885f1 1892) uid 001630
c71f4da9 190lf t55 wr b 1 d FF8B6B20
191lf t55 wr b 2 d F19B84A3
192lf t55 wr b 3 d 18058007
193lf t55 wr b 4 d 1200857C
194
2d1885f1 1953) uid 39feff
196lf t55xx wr b 1 d ffbfa73e
197lf t55xx wr b 2 d 4c0003ff
198lf t55xx wr b 3 d ffbfa73e
199lf t55xx wr b 4 d 4c0003ff
200
c71f4da9 201*/
56bbb25a 202
203int CmdLFNedapRead(const char *Cmd) {
204 CmdLFRead("s");
53484563 205 getSamples("12000", TRUE);
c71f4da9 206 return CmdLFNedapDemod("");
56bbb25a 207}
208/*
209int CmdLFNedapClone(const char *Cmd) {
210
211 char cmdp = param_getchar(Cmd, 0);
212 if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_nedap_clone();
213
214 uint32_t cardnumber=0, cn = 0;
215 uint32_t blocks[5];
216 uint8_t i;
217 uint8_t bs[128];
218 memset(bs, 0x00, sizeof(bs));
219
220 if (sscanf(Cmd, "%u", &cn ) != 1) return usage_lf_nedap_clone();
221
222 cardnumber = (cn & 0x00FFFFFF);
223
224 if ( !GetNedapBits(cardnumber, bs)) {
225 PrintAndLog("Error with tag bitstream generation.");
226 return 1;
227 }
228
8cdf15c2 229 ((ASK/DIphase data rawdemod ab 0 64 1 0
230 //NEDAP - compat mode, ASK/DIphase, data rate 64, 4 data blocks
231 // DI-pahse (CDP) T55x7_MODULATION_DIPHASE
ff9c043d 232 blocks[0] = T55x7_MODULATION_DIPHASE | T55x7_BITRATE_RF_64 | 7 << T55x7_MAXBLOCK_SHIFT;
56bbb25a 233
234 if (param_getchar(Cmd, 3) == 'Q' || param_getchar(Cmd, 3) == 'q')
890ae3dd 235 //t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
ff9c043d 236 blocks[0] = T5555_MODULATION_BIPHASE | T5555_INVERT_OUTPUT | ((64-2)>>1) << T5555_BITRATE_SHIFT | 7 <<T5555_MAXBLOCK_SHIFT;
56bbb25a 237
238 blocks[1] = bytebits_to_byte(bs,32);
239 blocks[2] = bytebits_to_byte(bs+32,32);
240 blocks[3] = bytebits_to_byte(bs+64,32);
241 blocks[4] = bytebits_to_byte(bs+96,32);
242
243 PrintAndLog("Preparing to clone NEDAP to T55x7 with card number: %u", cardnumber);
244 PrintAndLog("Blk | Data ");
245 PrintAndLog("----+------------");
246 for ( i = 0; i<5; ++i )
247 PrintAndLog(" %02d | %08" PRIx32, i, blocks[i]);
248
249 UsbCommand resp;
250 UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}};
251
252 for ( i = 0; i<5; ++i ) {
253 c.arg[0] = blocks[i];
254 c.arg[1] = i;
255 clearCommandBuffer();
256 SendCommand(&c);
42c235e7 257 if (!WaitForResponseTimeout(CMD_ACK, &resp, T55XX_WRITE_TIMEOUT)){
56bbb25a 258 PrintAndLog("Error occurred, device did not respond during write operation.");
259 return -1;
260 }
261 }
262 return 0;
263}
264*/
265
266int CmdLFNedapSim(const char *Cmd) {
267
268 char cmdp = param_getchar(Cmd, 0);
269 if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_nedap_sim();
270
271 uint32_t cardnumber = 0, cn = 0;
272
273 uint8_t bs[128];
274 size_t size = sizeof(bs);
275 memset(bs, 0x00, size);
276
8cdf15c2 277 // NEDAP, Biphase = 2, clock 64, inverted, (DIPhase == inverted BIphase
56bbb25a 278 uint8_t encoding = 2, separator = 0, clk=64, invert=1;
279 uint16_t arg1, arg2;
280 arg1 = clk << 8 | encoding;
281 arg2 = invert << 8 | separator;
282
8ae9b358 283 if (sscanf(Cmd, "%u", &cn ) != 1) return usage_lf_nedap_sim();
56bbb25a 284 cardnumber = (cn & 0x00FFFFFF);
285
286 if ( !GetNedapBits(cardnumber, bs)) {
287 PrintAndLog("Error with tag bitstream generation.");
288 return 1;
289 }
290
291 PrintAndLog("Simulating Nedap - CardNumber: %u", cardnumber );
292
293 UsbCommand c = {CMD_ASK_SIM_TAG, {arg1, arg2, size}};
294 memcpy(c.d.asBytes, bs, size);
295 clearCommandBuffer();
296 SendCommand(&c);
297 return 0;
298}
299
c71f4da9 300int CmdLFNedapChk(const char *Cmd){
deba67ab 301 //301600714021BE
532bcd71 302 uint8_t data[256] = { 0x30, 0x16, 0x00, 0x71, 0x40, 0x21, 0xBE};
c71f4da9 303 int len = 0;
304 param_gethex_ex(Cmd, 0, data, &len);
305
306 len = ( len == 0 ) ? 5 : len>>1;
307
308 PrintAndLog("Input: [%d] %s", len, sprint_hex(data, len));
309
812513bf 310 //uint8_t last = GetParity(data, EVEN, 62);
311 //PrintAndLog("TEST PARITY:: %d | %d ", DemodBuffer[62], last);
532bcd71 312
c71f4da9 313 uint8_t cl = 0x1D, ch = 0x1D, carry = 0;
314 uint8_t al, bl, temp;
315
deba67ab 316 for (int i =len; i >= 0; --i){
c71f4da9 317 al = data[i];
318 for (int j = 8; j > 0; --j) {
319
320 bl = al ^ ch;
321 //printf("BL %02x | CH %02x \n", al, ch);
322
323 carry = (cl & 0x80) ? 1 : 0;
324 cl <<= 1;
325
326 temp = (ch & 0x80) ? 1 : 0;
327 ch = (ch << 1) | carry;
328 carry = temp;
329
330 carry = (al & 0x80) ? 1 : 0;
331 al <<= 1;
332
333 carry = (bl & 0x80) ? 1 : 0;
334 bl <<= 1;
335
336 if (carry) {
337 cl ^= 0x21;
338 ch ^= 0x10;
339 }
340 }
341 }
342
deba67ab 343 PrintAndLog("Nedap checksum: 0x%X", ((ch << 8) | cl) );
c71f4da9 344 return 0;
345}
346
347
56bbb25a 348static command_t CommandTable[] = {
349 {"help", CmdHelp, 1, "This help"},
c71f4da9 350 {"read", CmdLFNedapRead, 0, "Attempt to read and extract tag data"},
351// {"clone", CmdLFNedapClone,0, "<Card Number> clone nedap tag"},
352 {"sim", CmdLFNedapSim, 0, "<Card Number> simulate nedap tag"},
353 {"chk", CmdLFNedapChk, 1, "Calculate Nedap Checksum <uid bytes>"},
56bbb25a 354 {NULL, NULL, 0, NULL}
355};
356
357int CmdLFNedap(const char *Cmd) {
358 clearCommandBuffer();
359 CmdsParse(CommandTable, Cmd);
360 return 0;
361}
362
363int CmdHelp(const char *Cmd) {
364 CmdsHelp(CommandTable);
365 return 0;
366}
Impressum, Datenschutz