1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // High frequency Legic commands
9 //-----------------------------------------------------------------------------
14 #include "proxmark3.h"
17 #include "cmdparser.h"
18 #include "cmdhflegic.h"
21 static int CmdHelp(const char *Cmd
);
23 static command_t CommandTable
[] =
25 {"help", CmdHelp
, 1, "This help"},
26 {"decode", CmdLegicDecode
, 0, "Display deobfuscated and decoded LEGIC RF tag data (use after hf legic reader)"},
27 {"reader", CmdLegicRFRead
, 0, "[offset [length]] -- read bytes from a LEGIC card"},
28 {"save", CmdLegicSave
, 0, "<filename> [<length>] -- Store samples"},
29 {"load", CmdLegicLoad
, 0, "<filename> -- Restore samples"},
30 {"sim", CmdLegicRfSim
, 0, "[phase drift [frame drift [req/resp drift]]] Start tag simulator (use after load or read)"},
31 {"write", CmdLegicRfWrite
,0, "<offset> <length> -- Write sample buffer (user after load or read)"},
32 {"fill", CmdLegicRfFill
, 0, "<offset> <length> <value> -- Fill/Write tag with constant value"},
36 int CmdHFLegic(const char *Cmd
)
38 CmdsParse(CommandTable
, Cmd
);
42 int CmdHelp(const char *Cmd
)
44 CmdsHelp(CommandTable
);
49 * Output BigBuf and deobfuscate LEGIC RF tag data.
50 * This is based on information given in the talk held
51 * by Henryk Ploetz and Karsten Nohl at 26c3
53 int CmdLegicDecode(const char *Cmd
)
62 uint8_t data_buf
[1052]; // receiver buffer
63 char out_string
[3076]; // just use big buffer - bad practice
66 // copy data from proxmark into buffer
67 GetFromBigBuf(data_buf
,sizeof(data_buf
),0);
68 WaitForResponse(CMD_ACK
,NULL
);
70 // Output CDF System area (9 bytes) plus remaining header area (12 bytes)
72 PrintAndLog("\nCDF: System Area");
74 PrintAndLog("MCD: %02x, MSN: %02x %02x %02x, MCC: %02x",
84 switch (data_buf
[5]&0x7f) {
86 strncpy(token_type
, "IAM",sizeof(token_type
));
89 strcpy(token_type
, "SAM");
92 strcpy(token_type
, "GAM");
95 strcpy(token_type
, "???");
99 stamp_len
= 0xfc - data_buf
[6];
101 PrintAndLog("DCF: %02x %02x, Token_Type=%s (OLE=%01u), Stamp_len=%02u",
105 (data_buf
[5]&0x80)>>7,
109 PrintAndLog("WRP=%02u, WRC=%01u, RD=%01u, raw=%02x, SSC=%02x",
111 (data_buf
[7]&0x70)>>4,
112 (data_buf
[7]&0x80)>>7,
117 PrintAndLog("Remaining Header Area");
119 PrintAndLog("%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x",
135 PrintAndLog("\nADF: User Area");
138 for (n
=0; n
<64; n
++) {
139 segment_len
= ((data_buf
[i
+1]^crc
)&0x0f) * 256 + (data_buf
[i
]^crc
);
140 segment_flag
= ((data_buf
[i
+1]^crc
)&0xf0)>>4;
142 wrp
= (data_buf
[i
+2]^crc
);
143 wrc
= ((data_buf
[i
+3]^crc
)&0x70)>>4;
145 PrintAndLog("Segment %02u: raw header=%02x %02x %02x %02x, flag=%01x (valid=%01u, last=%01u), len=%04u, WRP=%02u, WRC=%02u, RD=%01u, CRC=%02x",
152 (segment_flag
&0x4)>>2,
153 (segment_flag
&0x8)>>3,
157 ((data_buf
[i
+3]^crc
)&0x80)>>7,
164 PrintAndLog("WRC protected area:");
165 for (k
=0, j
=0; k
< wrc
&& j
<(sizeof(out_string
)-3); k
++, i
++, j
+= 3) {
166 sprintf(&out_string
[j
], "%02x", (data_buf
[i
]^crc
));
167 out_string
[j
+2] = ' ';
170 out_string
[j
] = '\0';
172 PrintAndLog("%s", out_string
);
176 PrintAndLog("Remaining write protected area:");
178 for (k
=0, j
=0; k
< (wrp
-wrc
) && j
<(sizeof(out_string
)-3); k
++, i
++, j
+= 3) {
179 sprintf(&out_string
[j
], "%02x", (data_buf
[i
]^crc
));
180 out_string
[j
+2] = ' ';
183 out_string
[j
] = '\0';
185 PrintAndLog("%s", out_string
);
187 sprintf(out_string
,"Card ID: %2X%02X%02X",data_buf
[i
-4]^crc
,data_buf
[i
-3]^crc
,data_buf
[i
-2]^crc
);
188 PrintAndLog("%s", out_string
);
192 PrintAndLog("Remaining segment payload:");
193 for (k
=0, j
=0; k
< (segment_len
- wrp
- 5) && j
<(sizeof(out_string
)-3); k
++, i
++, j
+= 3) {
194 sprintf(&out_string
[j
], "%02x", (data_buf
[i
]^crc
));
195 out_string
[j
+2] = ' ';
198 out_string
[j
] = '\0';
200 PrintAndLog("%s", out_string
);
202 // end with last segment
203 if (segment_flag
& 0x8)
209 int CmdLegicRFRead(const char *Cmd
)
211 int byte_count
=0,offset
=0;
212 sscanf(Cmd
, "%i %i", &offset
, &byte_count
);
213 if(byte_count
== 0) byte_count
= -1;
214 if(byte_count
+ offset
> 1024) byte_count
= 1024 - offset
;
215 UsbCommand c
={CMD_READER_LEGIC_RF
, {offset
, byte_count
, 0}};
220 int CmdLegicLoad(const char *Cmd
)
222 char filename
[FILE_PATH_SIZE
] = {0x00};
225 if (param_getchar(Cmd
, 0) == 'h' || param_getchar(Cmd
, 0)== 0x00) {
226 PrintAndLog("It loads datasamples from the file `filename`");
227 PrintAndLog("Usage: hf legic load <file name>");
228 PrintAndLog(" sample: hf legic load filename");
233 if (len
> FILE_PATH_SIZE
) {
234 PrintAndLog("Filepath too long (was %s bytes), max allowed is %s ", len
, FILE_PATH_SIZE
);
237 memcpy(filename
, Cmd
, len
);
239 FILE *f
= fopen(filename
, "r");
241 PrintAndLog("couldn't open '%s'", Cmd
);
244 char line
[80]; int offset
= 0; unsigned int data
[8];
245 while(fgets(line
, sizeof(line
), f
)) {
246 int res
= sscanf(line
, "%x %x %x %x %x %x %x %x",
247 &data
[0], &data
[1], &data
[2], &data
[3],
248 &data
[4], &data
[5], &data
[6], &data
[7]);
250 PrintAndLog("Error: could not read samples");
254 UsbCommand c
={CMD_DOWNLOADED_SIM_SAMPLES_125K
, {offset
, 0, 0}};
255 int j
; for(j
= 0; j
< 8; j
++) {
256 c
.d
.asBytes
[j
] = data
[j
];
259 WaitForResponse(CMD_ACK
, NULL
);
263 PrintAndLog("loaded %u samples", offset
);
267 int CmdLegicSave(const char *Cmd
)
269 int requested
= 1024;
272 char filename
[FILE_PATH_SIZE
];
275 sscanf(Cmd
, " %s %i %i", filename
, &requested
, &offset
);
277 /* If no length given save entire legic read buffer */
278 /* round up to nearest 8 bytes so the saved data can be used with legicload */
279 if (requested
== 0) {
282 if (requested
% 8 != 0) {
283 int remainder
= requested
% 8;
284 requested
= requested
+ 8 - remainder
;
286 if (offset
+ requested
> sizeof(got
)) {
287 PrintAndLog("Tried to read past end of buffer, <bytes> + <offset> > 1024");
291 FILE *f
= fopen(filename
, "w");
293 PrintAndLog("couldn't open '%s'", Cmd
+1);
297 GetFromBigBuf(got
,requested
,offset
);
298 WaitForResponse(CMD_ACK
,NULL
);
300 for (int j
= 0; j
< requested
; j
+= 8) {
301 fprintf(f
, "%02x %02x %02x %02x %02x %02x %02x %02x\n",
312 if (delivered
>= requested
)
317 PrintAndLog("saved %u samples", delivered
);
321 int CmdLegicRfSim(const char *Cmd
)
323 UsbCommand c
={CMD_SIMULATE_TAG_LEGIC_RF
};
327 sscanf(Cmd
, " %" SCNi64
" %" SCNi64
" %" SCNi64
, &c
.arg
[0], &c
.arg
[1], &c
.arg
[2]);
332 int CmdLegicRfWrite(const char *Cmd
)
334 UsbCommand c
={CMD_WRITER_LEGIC_RF
};
335 int res
= sscanf(Cmd
, " 0x%" SCNx64
" 0x%" SCNx64
, &c
.arg
[0], &c
.arg
[1]);
337 PrintAndLog("Please specify the offset and length as two hex strings");
344 int CmdLegicRfFill(const char *Cmd
)
346 UsbCommand cmd
={CMD_WRITER_LEGIC_RF
};
347 int res
= sscanf(Cmd
, " 0x%" SCNx64
" 0x%" SCNx64
" 0x%" SCNx64
, &cmd
.arg
[0], &cmd
.arg
[1], &cmd
.arg
[2]);
349 PrintAndLog("Please specify the offset, length and value as two hex strings");
354 UsbCommand c
={CMD_DOWNLOADED_SIM_SAMPLES_125K
, {0, 0, 0}};
355 for(i
= 0; i
< 48; i
++) {
356 c
.d
.asBytes
[i
] = cmd
.arg
[2];
358 for(i
= 0; i
< 22; i
++) {
361 WaitForResponse(CMD_ACK
,NULL
);