]> git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfguard.c
FIX: some compiler warnings, sscanf is using unsigned int.
[proxmark3-svn] / client / cmdlfguard.c
1 //-----------------------------------------------------------------------------
2 //
3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
4 // at your option, any later version. See the LICENSE.txt file for the text of
5 // the license.
6 //-----------------------------------------------------------------------------
7 // Low frequency Farpoint / Pyramid tag commands
8 //-----------------------------------------------------------------------------
9
10 #include "cmdlfguard.h"
11 static int CmdHelp(const char *Cmd);
12
13 int usage_lf_guard_clone(void){
14 PrintAndLog("clone a Guardall tag to a T55x7 tag.");
15 PrintAndLog("The facility-code is 8-bit and the card number is 16-bit. Larger values are truncated. ");
16 PrintAndLog("Currently work only on 26bit");
17 PrintAndLog("");
18 PrintAndLog("Usage: lf guard clone <format> <Facility-Code> <Card-Number>");
19 PrintAndLog("Options :");
20 PrintAndLog(" <format> : format length 26|32|36|40");
21 PrintAndLog(" <Facility-Code> : 8-bit value facility code");
22 PrintAndLog(" <Card Number> : 16-bit value card number");
23 PrintAndLog("");
24 PrintAndLog("Sample : lf guard clone 123 11223");
25 return 0;
26 }
27
28 int usage_lf_guard_sim(void) {
29 PrintAndLog("Enables simulation of Guardall card with specified card number.");
30 PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
31 PrintAndLog("The facility-code is 8-bit and the card number is 16-bit. Larger values are truncated.");
32 PrintAndLog("Currently work only on 26bit");
33 PrintAndLog("");
34 PrintAndLog("Usage: lf guard sim <format> <Card-Number>");
35 PrintAndLog("Options :");
36 PrintAndLog(" <format> : format length 26|32|36|40");
37 PrintAndLog(" <Facility-Code> : 8-bit value facility code");
38 PrintAndLog(" <Card Number> : 16-bit value card number");
39 PrintAndLog("");
40 PrintAndLog("Sample : lf guard sim 123 11223");
41 return 0;
42 }
43
44 // Works for 26bits.
45 int GetGuardBits(uint8_t fmtlen, uint32_t fc, uint32_t cn, uint8_t *guardBits) {
46
47 uint8_t xorKey = 0x66;
48 uint8_t i;
49 uint8_t pre[96];
50 uint8_t rawbytes[12];
51 memset(pre, 0x00, sizeof(pre));
52 memset(rawbytes, 0x00, sizeof(rawbytes));
53
54 // add format length (decimal)
55 switch (fmtlen) {
56 case 32: {
57 rawbytes[1] = (32 << 2);
58
59 break;
60 }
61 case 36: {
62 // FC = ((ByteStream[3] & 0x7F)<<7) | (ByteStream[4]>>1);
63 // Card = ((ByteStream[4]&1)<<19) | (ByteStream[5]<<11) | (ByteStream[6]<<3) | (ByteStream[7]>>5);
64 rawbytes[1] = (36 << 2);
65 // Get 26 wiegand from FacilityCode, CardNumber
66 uint8_t wiegand[34];
67 memset(wiegand, 0x00, sizeof(wiegand));
68 num_to_bytebits(fc, 8, wiegand);
69 num_to_bytebits(cn, 26, wiegand+8);
70
71 // add wiegand parity bits (dest, source, len)
72 wiegand_add_parity(pre, wiegand, 34);
73 break;
74 }
75 case 40: {
76 rawbytes[1] = (40 << 2);
77 break;
78 }
79 case 26:
80 default: {
81 rawbytes[1] = (26 << 2);
82 // Get 26 wiegand from FacilityCode, CardNumber
83 uint8_t wiegand[24];
84 memset(wiegand, 0x00, sizeof(wiegand));
85 num_to_bytebits(fc, 8, wiegand);
86 num_to_bytebits(cn, 16, wiegand+8);
87
88 // add wiegand parity bits (dest, source, len)
89 wiegand_add_parity(pre, wiegand, 24);
90 break;
91 }
92 }
93 // 2bit checksum, unknown today,
94 // these two bits are the last ones of rawbyte[1], hence the LSHIFT above.
95
96
97 // xor key
98 rawbytes[0] = xorKey;
99
100 rawbytes[2] = 1;
101 rawbytes[3] = 0;
102
103 // add wiegand to rawbytes
104 for (i = 0; i < 4; ++i)
105 rawbytes[i+4] = bytebits_to_byte( pre + (i*8), 8);
106
107 if (g_debugMode) printf(" WIE | %s\n", sprint_hex(rawbytes, sizeof(rawbytes)));
108
109
110 // XOR (only works on wiegand stuff)
111 for (i = 1; i < 12; ++i)
112 rawbytes[i] ^= xorKey ;
113
114 if (g_debugMode) printf(" XOR | %s \n", sprint_hex(rawbytes, sizeof(rawbytes)));
115
116 // convert rawbytes to bits in pre
117 for (i = 0; i < 12; ++i)
118 num_to_bytebitsLSBF( rawbytes[i], 8, pre + (i*8));
119
120 if (g_debugMode) printf("\n Raw | %s \n", sprint_hex(rawbytes, sizeof(rawbytes)));
121 if (g_debugMode) printf(" Raw | %s\n", sprint_bin(pre, 64) );
122
123 // add spacer bit 0 every 4 bits, starting with index 0,
124 // 12 bytes, 24 nibbles. 24+1 extra bites. 3bytes. ie 9bytes | 1byte xorkey, 8bytes rawdata (64bits, should be enough for a 40bit wiegand)
125 addParity(pre, guardBits+6, 64, 5, 3);
126
127 // preamble
128 guardBits[0] = 1;
129 guardBits[1] = 1;
130 guardBits[2] = 1;
131 guardBits[3] = 1;
132 guardBits[4] = 1;
133 guardBits[5] = 0;
134
135 if (g_debugMode) printf(" FIN | %s\n", sprint_bin(guardBits, 96) );
136 return 1;
137 }
138
139 int CmdGuardRead(const char *Cmd) {
140 CmdLFRead("s");
141 getSamples("12000", TRUE);
142 return CmdG_Prox_II_Demod("");
143 }
144
145 int CmdGuardClone(const char *Cmd) {
146
147 char cmdp = param_getchar(Cmd, 0);
148 if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_guard_clone();
149
150 uint32_t facilitycode = 0, cardnumber = 0, fc = 0, cn = 0, fmtlen = 0;
151 uint8_t i;
152 uint8_t bs[96];
153 memset(bs, 0x00, sizeof(bs));
154
155 //GuardProxII - compat mode, ASK/Biphase, data rate 64, 3 data blocks
156 uint32_t blocks[5] = {T55x7_MODULATION_BIPHASE | T55x7_BITRATE_RF_64 | 3 << T55x7_MAXBLOCK_SHIFT, 0, 0, 0, 0};
157
158 if (param_getchar(Cmd, 3) == 'Q' || param_getchar(Cmd, 3) == 'q')
159 //t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
160 blocks[0] = T5555_MODULATION_FSK2 | ((50-2)>>1) << T5555_BITRATE_SHIFT | 3 << T5555_MAXBLOCK_SHIFT;
161
162 if (sscanf(Cmd, "%u %u %u", &fmtlen, &fc, &cn ) != 2) return usage_lf_guard_clone();
163
164 fmtlen &= 0x7f;
165 facilitycode = (fc & 0x000000FF);
166 cardnumber = (cn & 0x0000FFFF);
167
168 if ( !GetGuardBits(fmtlen, facilitycode, cardnumber, bs)) {
169 PrintAndLog("Error with tag bitstream generation.");
170 return 1;
171 }
172
173 blocks[1] = bytebits_to_byte(bs,32);
174 blocks[2] = bytebits_to_byte(bs+32,32);
175 blocks[3] = bytebits_to_byte(bs+64,32);
176
177 PrintAndLog("Preparing to clone Guardall to T55x7 with Facility Code: %u, Card Number: %u", facilitycode, cardnumber);
178 PrintAndLog("Blk | Data ");
179 PrintAndLog("----+------------");
180 for ( i = 0; i<4; ++i )
181 PrintAndLog(" %02d | 0x%08x", i, blocks[i]);
182
183 UsbCommand resp;
184 UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}};
185
186 for ( i = 0; i<4; ++i ) {
187 c.arg[0] = blocks[i];
188 c.arg[1] = i;
189 clearCommandBuffer();
190 SendCommand(&c);
191 if (!WaitForResponseTimeout(CMD_ACK, &resp, T55XX_WRITE_TIMEOUT)){
192 PrintAndLog("Error occurred, device did not respond during write operation.");
193 return -1;
194 }
195 }
196 return 0;
197 }
198
199 int CmdGuardSim(const char *Cmd) {
200
201 char cmdp = param_getchar(Cmd, 0);
202 if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_guard_sim();
203
204 uint32_t facilitycode = 0, cardnumber = 0, fc = 0, cn = 0, fmtlen = 0;
205 uint8_t clock = 64, encoding = 2, separator = 0, invert = 0;
206
207 uint8_t bs[96];
208 memset(bs, 0x00, sizeof(bs));
209
210 if (sscanf(Cmd, "%u %u %u", &fmtlen, &fc, &cn ) != 2) return usage_lf_guard_sim();
211
212 fmtlen &= 0x7F;
213 facilitycode = (fc & 0x000000FF);
214 cardnumber = (cn & 0x0000FFFF);
215
216 if ( !GetGuardBits(fmtlen, facilitycode, cardnumber, bs)) {
217 PrintAndLog("Error with tag bitstream generation.");
218 return 1;
219 }
220
221 PrintAndLog("Simulating Guardall - Facility Code: %u, CardNumber: %u", facilitycode, cardnumber );
222
223 // Guard uses: clk: 64, invert: 0, encoding: 2 (ASK Biphase)
224 uint64_t arg1, arg2;
225 arg1 = (clock << 8) | encoding;
226 arg2 = (invert << 8) | separator;
227
228 uint8_t rawbytes[12];
229 size_t size = sizeof(rawbytes);
230 for (uint8_t i=0; i < size; ++i){
231 rawbytes[i] = bytebits_to_byte( bs + (i*8), 8);
232 }
233
234 UsbCommand c = {CMD_ASK_SIM_TAG, {arg1, arg2, size}};
235 memcpy(c.d.asBytes, rawbytes, size );
236 clearCommandBuffer();
237 SendCommand(&c);
238 return 0;
239 }
240
241 static command_t CommandTable[] = {
242 {"help", CmdHelp, 1, "This help"},
243 {"read", CmdGuardRead, 0, "Attempt to read and extract tag data"},
244 {"clone", CmdGuardClone, 0, "<Facility-Code> <Card Number> clone Guardall tag"},
245 {"sim", CmdGuardSim, 0, "<Facility-Code> <Card Number> simulate Guardall tag"},
246 {NULL, NULL, 0, NULL}
247 };
248
249 int CmdLFGuard(const char *Cmd) {
250 clearCommandBuffer();
251 CmdsParse(CommandTable, Cmd);
252 return 0;
253 }
254
255 int CmdHelp(const char *Cmd) {
256 CmdsHelp(CommandTable);
257 return 0;
258 }
Impressum, Datenschutz