1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // High frequency Legic commands
9 //-----------------------------------------------------------------------------
13 #include "proxmark3.h"
16 #include "cmdparser.h"
17 #include "cmdhflegic.h"
21 static int CmdHelp(const char *Cmd
);
23 int usage_legic_calccrc8(void){
24 PrintAndLog("Calculates the legic crc8 on the input hexbytes.");
25 PrintAndLog("There must be an even number of hexsymbols as input.");
26 PrintAndLog("Usage: hf legic crc8 <hexbytes>");
27 PrintAndLog("Options :");
28 PrintAndLog(" <hexbytes> : hex bytes in a string");
30 PrintAndLog("Sample : hf legic crc8 deadbeef1122");
34 int usage_legic_load(void){
35 PrintAndLog("It loads datasamples from the file `filename` to device memory");
36 PrintAndLog("Usage: hf legic load <file name>");
37 PrintAndLog(" sample: hf legic load filename");
42 * Output BigBuf and deobfuscate LEGIC RF tag data.
43 * This is based on information given in the talk held
44 * by Henryk Ploetz and Karsten Nohl at 26c3
46 int CmdLegicDecode(const char *Cmd
) {
47 // Index for the bytearray.
49 int k
= 0, segmentNum
;
52 uint8_t stamp_len
= 0;
56 uint8_t data_buf
[1200]; // receiver buffer, should be 1024..
59 // copy data from proxmark into buffer
60 GetFromBigBuf(data_buf
,sizeof(data_buf
),0);
61 WaitForResponse(CMD_ACK
,NULL
);
63 // Output CDF System area (9 bytes) plus remaining header area (12 bytes)
65 uint32_t calc_crc
= CRC8Legic(data_buf
, 4);
67 PrintAndLog("\nCDF: System Area");
69 PrintAndLog("MCD: %02x, MSN: %02x %02x %02x, MCC: %02x %s",
75 (calc_crc
== crc
) ? "OK":"Fail"
78 switch (data_buf
[5] & 0x7f) {
80 strncpy(token_type
, "IAM",sizeof(token_type
));
83 strncpy(token_type
, "SAM",sizeof(token_type
));
86 strncpy(token_type
, "GAM",sizeof(token_type
));
89 strncpy(token_type
, "???",sizeof(token_type
));
93 stamp_len
= 0xfc - data_buf
[6];
95 PrintAndLog("DCF: %02x %02x, Token_Type=%s (OLE=%01u), Stamp_len=%02u",
99 (data_buf
[5]&0x80)>>7,
103 PrintAndLog("WRP=%02u, WRC=%01u, RD=%01u, raw=%02x, SSC=%02x",
105 (data_buf
[7]&0x70)>>4,
106 (data_buf
[7]&0x80)>>7,
111 PrintAndLog("Remaining Header Area");
112 PrintAndLog("%s", sprint_hex(data_buf
+9, 13));
114 uint8_t segCrcBytes
[8] = {0x00};
115 uint32_t segCalcCRC
= 0;
118 PrintAndLog("\nADF: User Area");
120 // 64 potential segements
121 for ( segmentNum
=0; segmentNum
<64; segmentNum
++ ) {
122 segment_len
= ((data_buf
[i
+1]^crc
)&0x0f) * 256 + (data_buf
[i
]^crc
);
123 segment_flag
= ((data_buf
[i
+1]^crc
)&0xf0)>>4;
125 wrp
= (data_buf
[i
+2]^crc
);
126 wrc
= ((data_buf
[i
+3]^crc
)&0x70)>>4;
128 bool hasWRC
= (wrc
> 0);
129 bool hasWRP
= (wrp
> wrc
);
130 int wrp_len
= (wrp
- wrc
);
131 int remain_seg_payload_len
= (segment_len
- wrp
- 5);
133 // validate segment-crc
134 segCrcBytes
[0]=data_buf
[0]; //uid0
135 segCrcBytes
[1]=data_buf
[1]; //uid1
136 segCrcBytes
[2]=data_buf
[2]; //uid2
137 segCrcBytes
[3]=data_buf
[3]; //uid3
138 segCrcBytes
[4]=(data_buf
[i
]^crc
); //hdr0
139 segCrcBytes
[5]=(data_buf
[i
+1]^crc
); //hdr1
140 segCrcBytes
[6]=(data_buf
[i
+2]^crc
); //hdr2
141 segCrcBytes
[7]=(data_buf
[i
+3]^crc
); //hdr3
143 segCalcCRC
= CRC8Legic(segCrcBytes
, 8);
144 segCRC
= data_buf
[i
+4]^crc
;
146 PrintAndLog("Segment %02u: raw header=%02x %02x %02x %02x, flag=%01x (valid=%01u, last=%01u), len=%04u, WRP=%02u, WRC=%02u, RD=%01u, CRC=%02x (%s)",
153 (segment_flag
& 0x4) >> 2,
154 (segment_flag
& 0x8) >> 3,
158 ((data_buf
[i
+3]^crc
) & 0x80) >> 7,
160 ( segCRC
== segCalcCRC
) ? "OK" : "fail"
166 PrintAndLog("WRC protected area: (I %d | K %d| WRC %d)", i
, k
, wrc
);
168 for ( k
=i
; k
< wrc
; k
++)
173 // for ( k=i; k < wrc; k += 8)
174 PrintAndLog("%s", sprint_hex( data_buf
+i
, wrc
) );
180 PrintAndLog("Remaining write protected area: (I %d | K %d | WRC %d | WRP %d WRP_LEN %d)",i
, k
, wrc
, wrp
, wrp_len
);
183 // if ( data_buf[k] > 0) {
184 // for (k=i; k < wrp_len; k++)
185 // data_buf[k] ^= crc;
188 // for (k=i; k < wrp_len; k += 16) {
190 PrintAndLog("%s", sprint_hex( data_buf
+i
, wrp_len
));
195 // if( wrp_len == 8 )
196 // PrintAndLog("Card ID: %2X%02X%02X", data_buf[i-4]^crc, data_buf[i-3]^crc, data_buf[i-2]^crc);
199 PrintAndLog("Remaining segment payload:");
201 // if ( data_buf[k] > 0 ) {
202 // for ( k=i; k < remain_seg_payload_len; k++)
203 // data_buf[k] ^= crc;
206 // for ( k=i; k < remain_seg_payload_len; k++)
207 PrintAndLog("%s", sprint_hex( data_buf
+i
, remain_seg_payload_len
) );
209 i
+= remain_seg_payload_len
;
211 // end with last segment
212 if (segment_flag
& 0x8) return 0;
218 int CmdLegicRFRead(const char *Cmd
) {
219 int byte_count
=0, offset
=0;
220 sscanf(Cmd
, "%i %i", &offset
, &byte_count
);
221 if(byte_count
== 0) byte_count
= -1;
222 if(byte_count
+ offset
> 1024) byte_count
= 1024 - offset
;
224 UsbCommand c
= {CMD_READER_LEGIC_RF
, {offset
, byte_count
, 0}};
225 clearCommandBuffer();
230 int CmdLegicLoad(const char *Cmd
) {
232 char cmdp
= param_getchar(Cmd
, 0);
233 if ( cmdp
== 'H' || cmdp
== 'h' || cmdp
== 0x00) return usage_legic_load();
235 char filename
[FILE_PATH_SIZE
] = {0x00};
236 int len
= strlen(Cmd
);
238 if (len
> FILE_PATH_SIZE
) {
239 PrintAndLog("Filepath too long (was %s bytes), max allowed is %s ", len
, FILE_PATH_SIZE
);
242 memcpy(filename
, Cmd
, len
);
244 FILE *f
= fopen(filename
, "r");
246 PrintAndLog("couldn't open '%s'", Cmd
);
252 uint8_t data
[USB_CMD_DATA_SIZE
] = {0x00};
255 while ( fgets(line
, sizeof(line
), f
) ) {
256 int res
= sscanf(line
, "%x %x %x %x %x %x %x %x",
257 (unsigned int *)&data
[index
],
258 (unsigned int *)&data
[index
+ 1],
259 (unsigned int *)&data
[index
+ 2],
260 (unsigned int *)&data
[index
+ 3],
261 (unsigned int *)&data
[index
+ 4],
262 (unsigned int *)&data
[index
+ 5],
263 (unsigned int *)&data
[index
+ 6],
264 (unsigned int *)&data
[index
+ 7]);
267 PrintAndLog("Error: could not read samples");
273 if ( index
== USB_CMD_DATA_SIZE
){
274 // PrintAndLog("sent %d | %d | %d", index, offset, totalbytes);
275 UsbCommand c
= { CMD_DOWNLOADED_SIM_SAMPLES_125K
, {offset
, 0, 0}};
276 memcpy(c
.d
.asBytes
, data
, sizeof(data
));
277 clearCommandBuffer();
279 if ( !WaitForResponseTimeout(CMD_ACK
, NULL
, 1500)){
280 PrintAndLog("Command execute timeout");
293 UsbCommand c
= { CMD_DOWNLOADED_SIM_SAMPLES_125K
, {offset
, 0, 0}};
294 memcpy(c
.d
.asBytes
, data
, 8);
295 clearCommandBuffer();
297 if ( !WaitForResponseTimeout(CMD_ACK
, NULL
, 1500)){
298 PrintAndLog("Command execute timeout");
304 PrintAndLog("loaded %u samples", totalbytes
);
308 int CmdLegicSave(const char *Cmd
) {
309 int requested
= 1024;
312 char filename
[FILE_PATH_SIZE
];
313 uint8_t got
[1024] = {0x00};
315 sscanf(Cmd
, " %s %i %i", filename
, &requested
, &offset
);
317 /* If no length given save entire legic read buffer */
318 /* round up to nearest 8 bytes so the saved data can be used with legicload */
322 if (requested
% 8 != 0) {
323 int remainder
= requested
% 8;
324 requested
= requested
+ 8 - remainder
;
327 if (offset
+ requested
> sizeof(got
)) {
328 PrintAndLog("Tried to read past end of buffer, <bytes> + <offset> > 1024");
332 FILE *f
= fopen(filename
, "w");
334 PrintAndLog("couldn't open '%s'", Cmd
+1);
338 GetFromBigBuf(got
, requested
, offset
);
339 WaitForResponse(CMD_ACK
, NULL
);
341 for (int j
= 0; j
< requested
; j
+= 8) {
342 fprintf(f
, "%02x %02x %02x %02x %02x %02x %02x %02x\n",
343 got
[j
+0], got
[j
+1], got
[j
+2], got
[j
+3],
344 got
[j
+4], got
[j
+5], got
[j
+6], got
[j
+7]
347 if (delivered
>= requested
) break;
351 PrintAndLog("saved %u samples", delivered
);
355 int CmdLegicRfSim(const char *Cmd
) {
356 UsbCommand c
= {CMD_SIMULATE_TAG_LEGIC_RF
, {6,3,0}};
357 sscanf(Cmd
, " %"lli
" %"lli
" %"lli
, &c
.arg
[0], &c
.arg
[1], &c
.arg
[2]);
358 clearCommandBuffer();
363 int CmdLegicRfWrite(const char *Cmd
) {
364 UsbCommand c
= {CMD_WRITER_LEGIC_RF
};
365 int res
= sscanf(Cmd
, " 0x%"llx
" 0x%"llx
, &c
.arg
[0], &c
.arg
[1]);
367 PrintAndLog("Please specify the offset and length as two hex strings");
370 clearCommandBuffer();
375 int CmdLegicRfFill(const char *Cmd
) {
376 UsbCommand cmd
= {CMD_WRITER_LEGIC_RF
};
377 int res
= sscanf(Cmd
, " 0x%"llx
" 0x%"llx
" 0x%"llx
, &cmd
.arg
[0], &cmd
.arg
[1], &cmd
.arg
[2]);
379 PrintAndLog("Please specify the offset, length and value as two hex strings");
384 UsbCommand c
= {CMD_DOWNLOADED_SIM_SAMPLES_125K
, {0, 0, 0}};
385 for(i
= 0; i
< 48; i
++) {
386 c
.d
.asBytes
[i
] = cmd
.arg
[2];
389 for(i
= 0; i
< 22; i
++) {
392 WaitForResponse(CMD_ACK
,NULL
);
394 clearCommandBuffer();
399 int CmdLegicCalcCrc8(const char *Cmd
){
401 int len
= strlen(Cmd
);
402 if (len
& 1 ) return usage_legic_calccrc8();
404 uint8_t *data
= malloc(len
);
405 if ( data
== NULL
) return 1;
407 param_gethex(Cmd
, 0, data
, len
);
409 uint32_t checksum
= CRC8Legic(data
, len
/2);
410 PrintAndLog("Bytes: %s || CRC8: %X", sprint_hex(data
, len
/2), checksum
);
415 static command_t CommandTable
[] = {
416 {"help", CmdHelp
, 1, "This help"},
417 {"decode", CmdLegicDecode
, 0, "Display deobfuscated and decoded LEGIC RF tag data (use after hf legic reader)"},
418 {"read", CmdLegicRFRead
, 0, "[offset][length] -- read bytes from a LEGIC card"},
419 {"save", CmdLegicSave
, 0, "<filename> [<length>] -- Store samples"},
420 {"load", CmdLegicLoad
, 0, "<filename> -- Restore samples"},
421 {"sim", CmdLegicRfSim
, 0, "[phase drift [frame drift [req/resp drift]]] Start tag simulator (use after load or read)"},
422 {"write", CmdLegicRfWrite
,0, "<offset> <length> -- Write sample buffer (user after load or read)"},
423 {"fill", CmdLegicRfFill
, 0, "<offset> <length> <value> -- Fill/Write tag with constant value"},
424 {"crc8", CmdLegicCalcCrc8
, 1, "Calculate Legic CRC8 over given hexbytes"},
425 {NULL
, NULL
, 0, NULL
}
428 int CmdHFLegic(const char *Cmd
) {
429 clearCommandBuffer();
430 CmdsParse(CommandTable
, Cmd
);
434 int CmdHelp(const char *Cmd
) {
435 CmdsHelp(CommandTable
);