| 1 | //----------------------------------------------------------------------------- |
| 2 | // Copyright (C) 2016 iceman |
| 3 | // |
| 4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, |
| 5 | // at your option, any later version. See the LICENSE.txt file for the text of |
| 6 | // the license. |
| 7 | //----------------------------------------------------------------------------- |
| 8 | // Analyse bytes commands |
| 9 | //----------------------------------------------------------------------------- |
| 10 | #include "cmdanalyse.h" |
| 11 | |
| 12 | static int CmdHelp(const char *Cmd); |
| 13 | |
| 14 | int usage_analyse_lcr(void) { |
| 15 | PrintAndLog("Specifying the bytes of a UID with a known LRC will find the last byte value"); |
| 16 | PrintAndLog("needed to generate that LRC with a rolling XOR. All bytes should be specified in HEX."); |
| 17 | PrintAndLog(""); |
| 18 | PrintAndLog("Usage: analyse lcr [h] <bytes>"); |
| 19 | PrintAndLog("Options:"); |
| 20 | PrintAndLog(" h This help"); |
| 21 | PrintAndLog(" <bytes> bytes to calc missing XOR in a LCR"); |
| 22 | PrintAndLog(""); |
| 23 | PrintAndLog("Samples:"); |
| 24 | PrintAndLog(" analyse lcr 04008064BA"); |
| 25 | PrintAndLog("expected output: Target (BA) requires final LRC XOR byte value: 5A"); |
| 26 | return 0; |
| 27 | } |
| 28 | |
| 29 | int usage_analyse_checksum(void) { |
| 30 | PrintAndLog("The bytes will be added with eachother and than limited with the applied mask"); |
| 31 | PrintAndLog("Finally compute ones' complement of the least significant bytes"); |
| 32 | PrintAndLog(""); |
| 33 | PrintAndLog("Usage: analyse chksum [h] b <bytes> m <mask>"); |
| 34 | PrintAndLog("Options:"); |
| 35 | PrintAndLog(" h This help"); |
| 36 | PrintAndLog(" b <bytes> bytes to calc missing XOR in a LCR"); |
| 37 | PrintAndLog(" m <mask> bit mask to limit the outpuyt"); |
| 38 | PrintAndLog(""); |
| 39 | PrintAndLog("Samples:"); |
| 40 | PrintAndLog(" analyse chksum b 137AF00A0A0D m FF"); |
| 41 | PrintAndLog("expected output: 0x61"); |
| 42 | return 0; |
| 43 | } |
| 44 | |
| 45 | int usage_analyse_crc(void){ |
| 46 | PrintAndLog("A stub method to test different crc implementations inside the PM3 sourcecode. Just because you figured out the poly, doesn't mean you get the desired output"); |
| 47 | PrintAndLog(""); |
| 48 | PrintAndLog("Usage: analyse crc [h] <bytes>"); |
| 49 | PrintAndLog("Options:"); |
| 50 | PrintAndLog(" h This help"); |
| 51 | PrintAndLog(" <bytes> bytes to calc crc"); |
| 52 | PrintAndLog(""); |
| 53 | PrintAndLog("Samples:"); |
| 54 | PrintAndLog(" analyse crc 137AF00A0A0D"); |
| 55 | return 0; |
| 56 | } |
| 57 | |
| 58 | static uint8_t calculateLRC( uint8_t* bytes, uint8_t len) { |
| 59 | uint8_t LRC = 0; |
| 60 | for (uint8_t i = 0; i < len; i++) |
| 61 | LRC ^= bytes[i]; |
| 62 | return LRC; |
| 63 | } |
| 64 | |
| 65 | static uint8_t calcSumCrumbAdd( uint8_t* bytes, uint8_t len, uint32_t mask) { |
| 66 | uint8_t sum = 0; |
| 67 | for (uint8_t i = 0; i < len; i++) { |
| 68 | sum += CRUMB(bytes[i], 0); |
| 69 | sum += CRUMB(bytes[i], 2); |
| 70 | sum += CRUMB(bytes[i], 4); |
| 71 | sum += CRUMB(bytes[i], 6); |
| 72 | } |
| 73 | sum &= mask; |
| 74 | return sum; |
| 75 | } |
| 76 | static uint8_t calcSumCrumbAddOnes( uint8_t* bytes, uint8_t len, uint32_t mask) { |
| 77 | return ~calcSumCrumbAdd(bytes, len, mask); |
| 78 | } |
| 79 | static uint8_t calcSumNibbleAdd( uint8_t* bytes, uint8_t len, uint32_t mask) { |
| 80 | uint8_t sum = 0; |
| 81 | for (uint8_t i = 0; i < len; i++) { |
| 82 | sum += NIBBLE_LOW(bytes[i]); |
| 83 | sum += NIBBLE_HIGH(bytes[i]); |
| 84 | } |
| 85 | sum &= mask; |
| 86 | return sum; |
| 87 | } |
| 88 | static uint8_t calcSumNibbleAddOnes( uint8_t* bytes, uint8_t len, uint32_t mask){ |
| 89 | return ~calcSumNibbleAdd(bytes, len, mask); |
| 90 | } |
| 91 | |
| 92 | static uint8_t calcSumByteAdd( uint8_t* bytes, uint8_t len, uint32_t mask) { |
| 93 | uint8_t sum = 0; |
| 94 | for (uint8_t i = 0; i < len; i++) |
| 95 | sum += bytes[i]; |
| 96 | sum &= mask; |
| 97 | return sum; |
| 98 | } |
| 99 | // Ones complement |
| 100 | static uint8_t calcSumByteAddOnes( uint8_t* bytes, uint8_t len, uint32_t mask) { |
| 101 | return ~calcSumByteAdd(bytes, len, mask); |
| 102 | } |
| 103 | |
| 104 | static uint8_t calcSumByteSub( uint8_t* bytes, uint8_t len, uint32_t mask) { |
| 105 | uint8_t sum = 0; |
| 106 | for (uint8_t i = 0; i < len; i++) |
| 107 | sum -= bytes[i]; |
| 108 | sum &= mask; |
| 109 | return sum; |
| 110 | } |
| 111 | static uint8_t calcSumByteSubOnes( uint8_t* bytes, uint8_t len, uint32_t mask){ |
| 112 | return ~calcSumByteSub(bytes, len, mask); |
| 113 | } |
| 114 | static uint8_t calcSumNibbleSub( uint8_t* bytes, uint8_t len, uint32_t mask) { |
| 115 | uint8_t sum = 0; |
| 116 | for (uint8_t i = 0; i < len; i++) { |
| 117 | sum -= NIBBLE_LOW(bytes[i]); |
| 118 | sum -= NIBBLE_HIGH(bytes[i]); |
| 119 | } |
| 120 | sum &= mask; |
| 121 | return sum; |
| 122 | } |
| 123 | static uint8_t calcSumNibbleSubOnes( uint8_t* bytes, uint8_t len, uint32_t mask) { |
| 124 | return ~calcSumNibbleSub(bytes, len, mask); |
| 125 | } |
| 126 | |
| 127 | int CmdAnalyseLCR(const char *Cmd) { |
| 128 | uint8_t data[50]; |
| 129 | char cmdp = param_getchar(Cmd, 0); |
| 130 | if (strlen(Cmd) == 0|| cmdp == 'h' || cmdp == 'H') return usage_analyse_lcr(); |
| 131 | |
| 132 | int len = 0; |
| 133 | param_gethex_ex(Cmd, 0, data, &len); |
| 134 | if ( len%2 ) return usage_analyse_lcr(); |
| 135 | len >>= 1; |
| 136 | uint8_t finalXor = calculateLRC(data, len); |
| 137 | PrintAndLog("Target [%02X] requires final LRC XOR byte value: 0x%02X",data[len-1] ,finalXor); |
| 138 | return 0; |
| 139 | } |
| 140 | int CmdAnalyseCRC(const char *Cmd) { |
| 141 | |
| 142 | char cmdp = param_getchar(Cmd, 0); |
| 143 | if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_analyse_crc(); |
| 144 | |
| 145 | int len = strlen(Cmd); |
| 146 | if ( len & 1 ) return usage_analyse_crc(); |
| 147 | |
| 148 | // add 1 for null terminator. |
| 149 | uint8_t *data = malloc(len+1); |
| 150 | if ( data == NULL ) return 1; |
| 151 | |
| 152 | if ( param_gethex(Cmd, 0, data, len)) { |
| 153 | free(data); |
| 154 | return usage_analyse_crc(); |
| 155 | } |
| 156 | len >>= 1; |
| 157 | |
| 158 | //PrintAndLog("\nTests with '%s' hex bytes", sprint_hex(data, len)); |
| 159 | |
| 160 | PrintAndLog("\nTests of reflection. Two current methods in source code"); |
| 161 | PrintAndLog(" reflect(0x3e23L,3) is %04X == 0x3e26", reflect(0x3e23L,3) ); |
| 162 | PrintAndLog(" SwapBits(0x3e23L,3) is %04X == 0x3e26", SwapBits(0x3e23L,3) ); |
| 163 | PrintAndLog(" 0xB400 == %04X", reflect( (1 << 16 | 0xb400),16) ); |
| 164 | |
| 165 | // |
| 166 | // Test of CRC16, '123456789' string. |
| 167 | // |
| 168 | PrintAndLog("\nTests with '123456789' string"); |
| 169 | uint8_t dataStr[] = { 0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39 }; |
| 170 | uint8_t legic8 = CRC8Legic(dataStr, sizeof(dataStr)); |
| 171 | |
| 172 | PrintAndLog("LEGIC: CRC16: %X", CRC16Legic(dataStr, sizeof(dataStr), legic8)); |
| 173 | |
| 174 | //these below has been tested OK. |
| 175 | PrintAndLog("Confirmed CRC Implementations"); |
| 176 | PrintAndLog("LEGIC: CRC8 : %X (0xC6 expected)", legic8); |
| 177 | PrintAndLog("MAXIM: CRC8 : %X (0xA1 expected)", CRC8Maxim(dataStr, sizeof(dataStr))); |
| 178 | PrintAndLog("DNP : CRC16: %X (0x82EA expected)", CRC16_DNP(dataStr, sizeof(dataStr))); |
| 179 | PrintAndLog("CCITT: CRC16: %X (0xE5CC expected)", CRC16_CCITT(dataStr, sizeof(dataStr))); |
| 180 | |
| 181 | PrintAndLog("ICLASS org: CRC16: %X (0x expected)",iclass_crc16( (char*)dataStr, sizeof(dataStr))); |
| 182 | PrintAndLog("ICLASS ice: CRC16: %X (0x expected)",CRC16_ICLASS(dataStr, sizeof(dataStr))); |
| 183 | |
| 184 | |
| 185 | |
| 186 | uint8_t dataStr1234[] = { 0x1,0x2,0x3,0x4}; |
| 187 | PrintAndLog("ISO15693 org: : CRC16: %X (0xF0B8 expected)", Iso15693Crc(dataStr1234, sizeof(dataStr1234))); |
| 188 | PrintAndLog("ISO15693 ice: : CRC16: %X (0xF0B8 expected)", CRC16_Iso15693(dataStr1234, sizeof(dataStr1234))); |
| 189 | |
| 190 | free(data); |
| 191 | return 0; |
| 192 | } |
| 193 | int CmdAnalyseCHKSUM(const char *Cmd){ |
| 194 | |
| 195 | uint8_t data[50]; |
| 196 | uint8_t cmdp = 0; |
| 197 | uint32_t mask = 0xFF; |
| 198 | bool errors = false; |
| 199 | int len = 0; |
| 200 | memset(data, 0x0, sizeof(data)); |
| 201 | |
| 202 | while(param_getchar(Cmd, cmdp) != 0x00) { |
| 203 | switch(param_getchar(Cmd, cmdp)) { |
| 204 | case 'b': |
| 205 | case 'B': |
| 206 | param_gethex_ex(Cmd, cmdp+1, data, &len); |
| 207 | if ( len%2 ) errors = true; |
| 208 | len >>= 1; |
| 209 | cmdp += 2; |
| 210 | break; |
| 211 | case 'm': |
| 212 | case 'M': |
| 213 | mask = param_get32ex(Cmd, cmdp+1, 0, 16); |
| 214 | cmdp += 2; |
| 215 | break; |
| 216 | case 'h': |
| 217 | case 'H': |
| 218 | return usage_analyse_checksum(); |
| 219 | default: |
| 220 | PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp)); |
| 221 | errors = true; |
| 222 | break; |
| 223 | } |
| 224 | if(errors) break; |
| 225 | } |
| 226 | //Validations |
| 227 | if(errors) return usage_analyse_checksum(); |
| 228 | |
| 229 | PrintAndLog("\nByte Add | 0x%X", calcSumByteAdd(data, len, mask)); |
| 230 | PrintAndLog("Nibble Add | 0x%X", calcSumNibbleAdd(data, len, mask)); |
| 231 | PrintAndLog("Crumb Add | 0x%X", calcSumCrumbAdd(data, len, mask)); |
| 232 | |
| 233 | PrintAndLog("\nByte Subtract | 0x%X", calcSumByteSub(data, len, mask)); |
| 234 | PrintAndLog("Nibble Subtract | 0x%X", calcSumNibbleSub(data, len, mask)); |
| 235 | |
| 236 | PrintAndLog("\nCHECKSUM - One's complement"); |
| 237 | PrintAndLog("Byte Add | 0x%X", calcSumByteAddOnes(data, len, mask)); |
| 238 | PrintAndLog("Nibble Add | 0x%X", calcSumNibbleAddOnes(data, len, mask)); |
| 239 | PrintAndLog("Crumb Add | 0x%X", calcSumCrumbAddOnes(data, len, mask)); |
| 240 | |
| 241 | PrintAndLog("Byte Subtract | 0x%X", calcSumByteSubOnes(data, len, mask)); |
| 242 | PrintAndLog("Nibble Subtract | 0x%X", calcSumNibbleSubOnes(data, len, mask)); |
| 243 | |
| 244 | return 0; |
| 245 | } |
| 246 | |
| 247 | int CmdAnalyseDates(const char *Cmd){ |
| 248 | // look for datestamps in a given array of bytes |
| 249 | PrintAndLog("To be implemented. Feel free to contribute!"); |
| 250 | return 0; |
| 251 | } |
| 252 | int CmdAnalyseTEASelfTest(const char *Cmd){ |
| 253 | |
| 254 | uint8_t v[8], v_le[8]; |
| 255 | memset(v, 0x00, sizeof(v)); |
| 256 | memset(v_le, 0x00, sizeof(v_le)); |
| 257 | uint8_t* v_ptr = v_le; |
| 258 | |
| 259 | uint8_t cmdlen = strlen(Cmd); |
| 260 | cmdlen = ( sizeof(v)<<2 < cmdlen ) ? sizeof(v)<<2 : cmdlen; |
| 261 | |
| 262 | if ( param_gethex(Cmd, 0, v, cmdlen) > 0 ){ |
| 263 | PrintAndLog("can't read hex chars, uneven? :: %u", cmdlen); |
| 264 | return 1; |
| 265 | } |
| 266 | |
| 267 | SwapEndian64ex(v , 8, 4, v_ptr); |
| 268 | |
| 269 | // ENCRYPTION KEY: |
| 270 | uint8_t key[16] = {0x55,0xFE,0xF6,0x30,0x62,0xBF,0x0B,0xC1,0xC9,0xB3,0x7C,0x34,0x97,0x3E,0x29,0xFB }; |
| 271 | uint8_t keyle[16]; |
| 272 | uint8_t* key_ptr = keyle; |
| 273 | SwapEndian64ex(key , sizeof(key), 4, key_ptr); |
| 274 | |
| 275 | PrintAndLog("TEST LE enc| %s", sprint_hex(v_ptr, 8)); |
| 276 | |
| 277 | tea_decrypt(v_ptr, key_ptr); |
| 278 | PrintAndLog("TEST LE dec | %s", sprint_hex_ascii(v_ptr, 8)); |
| 279 | |
| 280 | tea_encrypt(v_ptr, key_ptr); |
| 281 | tea_encrypt(v_ptr, key_ptr); |
| 282 | PrintAndLog("TEST enc2 | %s", sprint_hex_ascii(v_ptr, 8)); |
| 283 | |
| 284 | return 0; |
| 285 | } |
| 286 | |
| 287 | static command_t CommandTable[] = { |
| 288 | {"help", CmdHelp, 1, "This help"}, |
| 289 | {"lcr", CmdAnalyseLCR, 1, "Generate final byte for XOR LRC"}, |
| 290 | {"crc", CmdAnalyseCRC, 1, "Stub method for CRC evaluations"}, |
| 291 | {"chksum", CmdAnalyseCHKSUM, 1, "Checksum with adding, masking and one's complement"}, |
| 292 | {"dates", CmdAnalyseDates, 1, "Look for datestamps in a given array of bytes"}, |
| 293 | {"tea", CmdAnalyseTEASelfTest, 1, "Crypto TEA test"}, |
| 294 | {NULL, NULL, 0, NULL} |
| 295 | }; |
| 296 | |
| 297 | int CmdAnalyse(const char *Cmd) { |
| 298 | clearCommandBuffer(); |
| 299 | CmdsParse(CommandTable, Cmd); |
| 300 | return 0; |
| 301 | } |
| 302 | |
| 303 | int CmdHelp(const char *Cmd) { |
| 304 | CmdsHelp(CommandTable); |
| 305 | return 0; |
| 306 | } |