[proxmark3-svn] / client / cmdlfvisa2000.c

//-----------------------------------------------------------------------------
//
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
// at your option, any later version. See the LICENSE.txt file for the text of
// the license.
//-----------------------------------------------------------------------------
// Low frequency visa 2000 tag commands
// by iceman
// ASK/Manchester, RF/64, STT, 96 bits (complete)
//-----------------------------------------------------------------------------

#include "cmdlfvisa2000.h"

#include <stdio.h>
#include <string.h>
#include "proxmark3.h"
#include "ui.h"
#include "util.h"
#include "graph.h"
#include "cmddata.h"    // for ASKDemod_ext, g_debugMode, DemodBuffer ...
#include "cmdmain.h"    // for clearCommandBuffer and WaitForResponseTimeout
#include "cmdlf.h"
#include "protocols.h"  // for T55xx config register definitions
#include "lfdemod.h"    // for Visa2kDemod_AM

#define BL0CK1 0x56495332

static int CmdHelp(const char *Cmd);

int usage_lf_visa2k_clone(void){
	PrintAndLog("clone a Visa2000 tag to a T55x7 tag.");
	PrintAndLog("Usage: lf visa2000 clone [h] <card ID> <Q5>");
	PrintAndLog("Options:");
	PrintAndLog("      h          : This help");
	PrintAndLog("      <card ID>  : Visa2000 card ID");
	PrintAndLog("      <Q5>       : specify write to Q5 (t5555 instead of t55x7)");
	PrintAndLog("");
	PrintAndLog("Sample: lf visa2000 clone 112233");
	return 0;
}

int usage_lf_visa2k_sim(void) {
	PrintAndLog("Enables simulation of visa2000 card with specified card number.");
	PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
	PrintAndLog("");
	PrintAndLog("Usage:  lf visa2000 sim [h] <card ID>");
	PrintAndLog("Options:");
	PrintAndLog("      h          : This help");
	PrintAndLog("      <card ID>  : Visa2000 card ID");
	PrintAndLog("");
	PrintAndLog("Sample: lf visa2000 sim 112233");
	return 0;
}

static uint8_t visa_chksum( uint32_t id ) {
	uint8_t sum = 0;
	for (uint8_t i = 0; i < 32; i += 4)
		sum ^=  (id >> i) & 0xF;

	return sum;
}

static uint8_t visa_parity( uint32_t id) {
	// 4bit parity LUT
	uint8_t par_lut[] = {
		 0,1,1,0
		,1,0,0,1
		,1,0,0,1
		,0,1,1,0
	};
	uint8_t par = 0;
	par |= par_lut[ (id >> 28) & 0xF ] << 7;
	par |= par_lut[ (id >> 24) & 0xF ] << 6;
	par |= par_lut[ (id >> 20) & 0xF ] << 5;
	par |= par_lut[ (id >> 16) & 0xF ] << 4;
	par |= par_lut[ (id >> 12) & 0xF ] << 3;
	par |= par_lut[ (id >>  8) & 0xF ] << 2;
	par |= par_lut[ (id >>  4) & 0xF ] << 1;
	par |= par_lut[ (id & 0xF) ];
	return par;	
}


/**
*
* 56495332 00096ebd 00000077 —> tag id 618173
* aaaaaaaa iiiiiiii -----ppc
*
* a = fixed value  ascii 'VIS2'
* i = card id
* p = even parity bit for each nibble in card id.
* c = checksum  (xor of card id)
* 
**/
//see ASKDemod for what args are accepted
int CmdVisa2kDemod(const char *Cmd) {

	//sCmdAskEdgeDetect("");

	//ASK / Manchester
	bool st = true;
	if (!ASKDemod_ext("64 0 0", false, false, 1, &st)) {
		if (g_debugMode) PrintAndLog("DEBUG: Error - Visa2000: ASK/Manchester Demod failed");
		return 0;
	}
	size_t size = DemodBufferLen;
	int ans = Visa2kDemod_AM(DemodBuffer, &size);
	if (ans < 0){
		if (g_debugMode){
			if (ans == -1)
				PrintAndLog("DEBUG: Error - Visa2000: too few bits found");
			else if (ans == -2)
				PrintAndLog("DEBUG: Error - Visa2000: preamble not found");
			else if (ans == -3)
				PrintAndLog("DEBUG: Error - Visa2000: Size not correct: %d", size);
			else
				PrintAndLog("DEBUG: Error - Visa2000: ans: %d", ans);
		}
		return 0;
	}
	setDemodBuf(DemodBuffer, 96, ans);
	setClockGrid(g_DemodClock, g_DemodStartIdx + (ans*g_DemodClock));

	//got a good demod
	uint32_t raw1 = bytebits_to_byte(DemodBuffer, 32);
	uint32_t raw2 = bytebits_to_byte(DemodBuffer+32, 32);
	uint32_t raw3 = bytebits_to_byte(DemodBuffer+64, 32);

	// chksum
	uint8_t calc = visa_chksum(raw2);
	uint8_t chk = raw3 & 0xF;	

	// test checksums
	if ( chk != calc ) { 
		printf("DEBUG: error: Visa2000 checksum failed %x - %x\n", chk, calc);
		return 0;
	}
	// parity
	uint8_t calc_par = visa_parity(raw2);
	uint8_t chk_par = (raw3 & 0xFF0) >> 4;
	if ( calc_par != chk_par) {
		printf("DEBUG: error: Visa2000 parity failed %x - %x\n", chk_par, calc_par);
		return 0;
	}
	PrintAndLog("Visa2000 Tag Found: Card ID %u,  Raw: %08X%08X%08X", raw2,  raw1 ,raw2, raw3);
	return 1;
}

int CmdVisa2kRead(const char *Cmd) {
	//64*96*2=12288 samples just in case we just missed the first preamble we can still catch 2 of them
	lf_read(true, 12500);
	return CmdVisa2kDemod(Cmd);
}

int CmdVisa2kClone(const char *Cmd) {

	uint64_t id = 0;
	uint32_t blocks[4] = {T55x7_MODULATION_MANCHESTER | T55x7_BITRATE_RF_64 | T55x7_ST_TERMINATOR | 3 << T55x7_MAXBLOCK_SHIFT, BL0CK1, 0};

	char cmdp = param_getchar(Cmd, 0);
	if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_visa2k_clone();

	id = param_get32ex(Cmd, 0, 0, 10);
	
	//Q5
	if (param_getchar(Cmd, 1) == 'Q' || param_getchar(Cmd, 1) == 'q') {
		//t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
		blocks[0] = T5555_MODULATION_MANCHESTER | ((64-2)>>1) << T5555_BITRATE_SHIFT | T5555_ST_TERMINATOR | 3 << T5555_MAXBLOCK_SHIFT;
	}

	blocks[2] = id;
	blocks[3] = (visa_parity(id) << 4) | visa_chksum(id);

	PrintAndLog("Preparing to clone Visa2000 to T55x7 with CardId: %u", id);
	PrintAndLog("Blk | Data ");
	PrintAndLog("----+------------");
	for(int i = 0; i<4; ++i)
		PrintAndLog(" %02d | 0x%08x", i , blocks[i]);
	
	UsbCommand resp;
	UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}};

	for (int i = 3; i >= 0; --i) {
		c.arg[0] = blocks[i];
		c.arg[1] = i;
		clearCommandBuffer();
		SendCommand(&c);
		if (!WaitForResponseTimeout(CMD_ACK, &resp, T55XX_WRITE_TIMEOUT)){
			PrintAndLog("Error occurred, device did not respond during write operation.");
			return -1;
		}
	}
	return 0;
}

int CmdVisa2kSim(const char *Cmd) {

	uint32_t id = 0;
	char cmdp = param_getchar(Cmd, 0);
	if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_visa2k_sim();

	id = param_get32ex(Cmd, 0, 0, 10);

	uint8_t clk = 64, encoding = 1, separator = 1, invert = 0;
	uint16_t arg1, arg2;
	size_t size = 96;
	arg1 = clk << 8 | encoding;
	arg2 = invert << 8 | separator;

	PrintAndLog("Simulating Visa2000 - CardId: %u", id);

	UsbCommand c = {CMD_ASK_SIM_TAG, {arg1, arg2, size}};

	uint32_t blocks[3] = { BL0CK1, id, (visa_parity(id) << 4) | visa_chksum(id) };

	for(int i=0; i<3; ++i)
		num_to_bytebits(blocks[i], 32, c.d.asBytes + i*32);

	clearCommandBuffer();
	SendCommand(&c);
	return 0;
}

static command_t CommandTable[] = {
	{"help",  CmdHelp,        1, "This help"},
	{"demod", CmdVisa2kDemod, 1, "Attempt to demod from GraphBuffer"},
	{"read",  CmdVisa2kRead,  0, "Attempt to read and extract tag data"},
	{"clone", CmdVisa2kClone, 0, "clone Visa2000 tag"},
	{"sim",   CmdVisa2kSim,   0, "simulate Visa2000 tag"},
	{NULL, NULL, 0, NULL}
};

int CmdLFVisa2k(const char *Cmd) {
	clearCommandBuffer();
	CmdsParse(CommandTable, Cmd);
	return 0;
}

int CmdHelp(const char *Cmd) {
	CmdsHelp(CommandTable);
	return 0;
}
Commit	Line	Data
8b6abef5	1	//-----------------------------------------------------------------------------
	2	//
	3	// This code is licensed to you under the terms of the GNU GPL, version 2 or,
	4	// at your option, any later version. See the LICENSE.txt file for the text of
	5	// the license.
	6	//-----------------------------------------------------------------------------
946a84c3	7	// Low frequency visa 2000 tag commands
8b6abef5	8	// by iceman
b9957414	9	// ASK/Manchester, RF/64, STT, 96 bits (complete)
8b6abef5	10	//-----------------------------------------------------------------------------
	11
	12	#include "cmdlfvisa2000.h"
06919754	13
06919754	14	#include <stdio.h>
02069dbb	15	#include <string.h>
8b6abef5	16	#include "proxmark3.h"
	17	#include "ui.h"
	18	#include "util.h"
	19	#include "graph.h"
	20	#include "cmddata.h" // for ASKDemod_ext, g_debugMode, DemodBuffer ...
	21	#include "cmdmain.h" // for clearCommandBuffer and WaitForResponseTimeout
	22	#include "cmdlf.h"
	23	#include "protocols.h" // for T55xx config register definitions
	24	#include "lfdemod.h" // for Visa2kDemod_AM
	25
	26	#define BL0CK1 0x56495332
	27
	28	static int CmdHelp(const char *Cmd);
	29
	30	int usage_lf_visa2k_clone(void){
	31	PrintAndLog("clone a Visa2000 tag to a T55x7 tag.");
5c814c3a	32	PrintAndLog("Usage: lf visa2000 clone [h] <card ID> <Q5>");
8b6abef5	33	PrintAndLog("Options:");
8b6abef5	34	PrintAndLog(" h : This help");
5c814c3a	35	PrintAndLog(" <card ID> : Visa2000 card ID");
8b6abef5	36	PrintAndLog(" <Q5> : specify write to Q5 (t5555 instead of t55x7)");
8b6abef5	37	PrintAndLog("");
5c814c3a	38	PrintAndLog("Sample: lf visa2000 clone 112233");
8b6abef5	39	return 0;
	40	}
	41
	42	int usage_lf_visa2k_sim(void) {
5c814c3a	43	PrintAndLog("Enables simulation of visa2000 card with specified card number.");
8b6abef5	44	PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
8b6abef5	45	PrintAndLog("");
5c814c3a	46	PrintAndLog("Usage: lf visa2000 sim [h] <card ID>");
8b6abef5	47	PrintAndLog("Options:");
8b6abef5	48	PrintAndLog(" h : This help");
5c814c3a	49	PrintAndLog(" <card ID> : Visa2000 card ID");
8b6abef5	50	PrintAndLog("");
5c814c3a	51	PrintAndLog("Sample: lf visa2000 sim 112233");
8b6abef5	52	return 0;
	53	}
	54
	55	static uint8_t visa_chksum( uint32_t id ) {
	56	uint8_t sum = 0;
	57	for (uint8_t i = 0; i < 32; i += 4)
	58	sum ^= (id >> i) & 0xF;
	59
	60	return sum;
	61	}
	62
	63	static uint8_t visa_parity( uint32_t id) {
	64	// 4bit parity LUT
	65	uint8_t par_lut[] = {
	66	0,1,1,0
	67	,1,0,0,1
	68	,1,0,0,1
	69	,0,1,1,0
	70	};
	71	uint8_t par = 0;
	72	par \|= par_lut[ (id >> 28) & 0xF ] << 7;
	73	par \|= par_lut[ (id >> 24) & 0xF ] << 6;
	74	par \|= par_lut[ (id >> 20) & 0xF ] << 5;
	75	par \|= par_lut[ (id >> 16) & 0xF ] << 4;
	76	par \|= par_lut[ (id >> 12) & 0xF ] << 3;
	77	par \|= par_lut[ (id >> 8) & 0xF ] << 2;
	78	par \|= par_lut[ (id >> 4) & 0xF ] << 1;
	79	par \|= par_lut[ (id & 0xF) ];
	80	return par;
	81	}
	82
	83
	84	/**
	85	*
	86	* 56495332 00096ebd 00000077 —> tag id 618173
b9957414	87	* aaaaaaaa iiiiiiii -----ppc
8b6abef5	88	*
	89	* a = fixed value ascii 'VIS2'
	90	* i = card id
b9957414	91	* p = even parity bit for each nibble in card id.
8b6abef5	92	* c = checksum (xor of card id)
8b6abef5	93	*
	94	**/
	95	//see ASKDemod for what args are accepted
	96	int CmdVisa2kDemod(const char *Cmd) {
	97
	98	//sCmdAskEdgeDetect("");
	99
	100	//ASK / Manchester
	101	bool st = true;
	102	if (!ASKDemod_ext("64 0 0", false, false, 1, &st)) {
5c814c3a	103	if (g_debugMode) PrintAndLog("DEBUG: Error - Visa2000: ASK/Manchester Demod failed");
8b6abef5	104	return 0;
	105	}
	106	size_t size = DemodBufferLen;
	107	int ans = Visa2kDemod_AM(DemodBuffer, &size);
	108	if (ans < 0){
	109	if (g_debugMode){
	110	if (ans == -1)
5c814c3a	111	PrintAndLog("DEBUG: Error - Visa2000: too few bits found");
8b6abef5	112	else if (ans == -2)
5c814c3a	113	PrintAndLog("DEBUG: Error - Visa2000: preamble not found");
8b6abef5	114	else if (ans == -3)
5c814c3a	115	PrintAndLog("DEBUG: Error - Visa2000: Size not correct: %d", size);
8b6abef5	116	else
5c814c3a	117	PrintAndLog("DEBUG: Error - Visa2000: ans: %d", ans);
8b6abef5	118	}
	119	return 0;
	120	}
	121	setDemodBuf(DemodBuffer, 96, ans);
9fe4507c	122	setClockGrid(g_DemodClock, g_DemodStartIdx + (ans*g_DemodClock));
8b6abef5	123
	124	//got a good demod
	125	uint32_t raw1 = bytebits_to_byte(DemodBuffer, 32);
	126	uint32_t raw2 = bytebits_to_byte(DemodBuffer+32, 32);
	127	uint32_t raw3 = bytebits_to_byte(DemodBuffer+64, 32);
	128
	129	// chksum
	130	uint8_t calc = visa_chksum(raw2);
	131	uint8_t chk = raw3 & 0xF;
	132
	133	// test checksums
	134	if ( chk != calc ) {
	135	printf("DEBUG: error: Visa2000 checksum failed %x - %x\n", chk, calc);
	136	return 0;
	137	}
	138	// parity
	139	uint8_t calc_par = visa_parity(raw2);
	140	uint8_t chk_par = (raw3 & 0xFF0) >> 4;
	141	if ( calc_par != chk_par) {
	142	printf("DEBUG: error: Visa2000 parity failed %x - %x\n", chk_par, calc_par);
	143	return 0;
	144	}
	145	PrintAndLog("Visa2000 Tag Found: Card ID %u, Raw: %08X%08X%08X", raw2, raw1 ,raw2, raw3);
	146	return 1;
	147	}
	148
	149	int CmdVisa2kRead(const char *Cmd) {
8b6abef5	150	//64962=12288 samples just in case we just missed the first preamble we can still catch 2 of them
b9957414	151	lf_read(true, 12500);
8b6abef5	152	return CmdVisa2kDemod(Cmd);
	153	}
	154
	155	int CmdVisa2kClone(const char *Cmd) {
	156
	157	uint64_t id = 0;
	158	uint32_t blocks[4] = {T55x7_MODULATION_MANCHESTER \| T55x7_BITRATE_RF_64 \| T55x7_ST_TERMINATOR \| 3 << T55x7_MAXBLOCK_SHIFT, BL0CK1, 0};
	159
	160	char cmdp = param_getchar(Cmd, 0);
	161	if (strlen(Cmd) == 0 \|\| cmdp == 'h' \|\| cmdp == 'H') return usage_lf_visa2k_clone();
	162
	163	id = param_get32ex(Cmd, 0, 0, 10);
	164
	165	//Q5
	166	if (param_getchar(Cmd, 1) == 'Q' \|\| param_getchar(Cmd, 1) == 'q') {
	167	//t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
	168	blocks[0] = T5555_MODULATION_MANCHESTER \| ((64-2)>>1) << T5555_BITRATE_SHIFT \| T5555_ST_TERMINATOR \| 3 << T5555_MAXBLOCK_SHIFT;
	169	}
	170
	171	blocks[2] = id;
	172	blocks[3] = (visa_parity(id) << 4) \| visa_chksum(id);
	173
	174	PrintAndLog("Preparing to clone Visa2000 to T55x7 with CardId: %u", id);
	175	PrintAndLog("Blk \| Data ");
	176	PrintAndLog("----+------------");
	177	for(int i = 0; i<4; ++i)
	178	PrintAndLog(" %02d \| 0x%08x", i , blocks[i]);
	179
	180	UsbCommand resp;
	181	UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}};
	182
	183	for (int i = 3; i >= 0; --i) {
	184	c.arg[0] = blocks[i];
	185	c.arg[1] = i;
	186	clearCommandBuffer();
	187	SendCommand(&c);
	188	if (!WaitForResponseTimeout(CMD_ACK, &resp, T55XX_WRITE_TIMEOUT)){
	189	PrintAndLog("Error occurred, device did not respond during write operation.");
	190	return -1;
	191	}
	192	}
	193	return 0;
	194	}
	195
	196	int CmdVisa2kSim(const char *Cmd) {
	197
	198	uint32_t id = 0;
	199	char cmdp = param_getchar(Cmd, 0);
	200	if (strlen(Cmd) == 0 \|\| cmdp == 'h' \|\| cmdp == 'H') return usage_lf_visa2k_sim();
	201
	202	id = param_get32ex(Cmd, 0, 0, 10);
	203
	204	uint8_t clk = 64, encoding = 1, separator = 1, invert = 0;
	205	uint16_t arg1, arg2;
	206	size_t size = 96;
	207	arg1 = clk << 8 \| encoding;
	208	arg2 = invert << 8 \| separator;
	209
	210	PrintAndLog("Simulating Visa2000 - CardId: %u", id);
	211
	212	UsbCommand c = {CMD_ASK_SIM_TAG, {arg1, arg2, size}};
	213
	214	uint32_t blocks[3] = { BL0CK1, id, (visa_parity(id) << 4) \| visa_chksum(id) };
	215
216	for(int i=0; i<3; ++i)
217	num_to_bytebits(blocks[i], 32, c.d.asBytes + i*32);
218
219	clearCommandBuffer();
220	SendCommand(&c);
221	return 0;
222	}
223
224	static command_t CommandTable[] = {
225	{"help", CmdHelp, 1, "This help"},
226	{"demod", CmdVisa2kDemod, 1, "Attempt to demod from GraphBuffer"},
227	{"read", CmdVisa2kRead, 0, "Attempt to read and extract tag data"},
228	{"clone", CmdVisa2kClone, 0, "clone Visa2000 tag"},
229	{"sim", CmdVisa2kSim, 0, "simulate Visa2000 tag"},
230	{NULL, NULL, 0, NULL}
231	};
232
233	int CmdLFVisa2k(const char *Cmd) {
234	clearCommandBuffer();
235	CmdsParse(CommandTable, Cmd);
236	return 0;
237	}
238
239	int CmdHelp(const char *Cmd) {
240	CmdsHelp(CommandTable);
241	return 0;
242	}