git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfguard.c

   1 //-----------------------------------------------------------------------------
   2 //
   3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   4 // at your option, any later version. See the LICENSE.txt file for the text of
   5 // the license.
   6 //-----------------------------------------------------------------------------
   7 // Low frequency Farpoint / Pyramid tag commands
   8 //-----------------------------------------------------------------------------
   9
  10 #include "cmdlfguard.h"
  11 static int CmdHelp(const char *Cmd);
  12
  13 int usage_lf_guard_clone(void){
  14         PrintAndLog("clone a Guardall tag to a T55x7 tag.");
  15         PrintAndLog("The facility-code is 8-bit and the card number is 16-bit.  Larger values are truncated. ");
  16         PrintAndLog("Currently work only on 26bit");
  17         PrintAndLog("");
  18         PrintAndLog("Usage: lf guard clone <format> <Facility-Code> <Card-Number>");
  19         PrintAndLog("Options :");
  20         PrintAndLog("         <format> :  format length 26|32|36|40");
  21         PrintAndLog("  <Facility-Code> :  8-bit value facility code");
  22         PrintAndLog("  <Card Number>   : 16-bit value card number");
  23         PrintAndLog("");
  24         PrintAndLog("Sample  : lf guard clone 123 11223");
  25         return 0;
  26 }
  27
  28 int usage_lf_guard_sim(void) {
  29         PrintAndLog("Enables simulation of Guardall card with specified card number.");
  30         PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
  31         PrintAndLog("The facility-code is 8-bit and the card number is 16-bit.  Larger values are truncated.");
  32         PrintAndLog("Currently work only on 26bit");
  33         PrintAndLog("");
  34         PrintAndLog("Usage:  lf guard sim <format> <Card-Number>");
  35         PrintAndLog("Options :");
  36         PrintAndLog("         <format> :  format length 26|32|36|40");
  37         PrintAndLog("  <Facility-Code> :  8-bit value facility code");
  38         PrintAndLog("  <Card Number>   : 16-bit value card number");
  39         PrintAndLog("");
  40         PrintAndLog("Sample  : lf guard sim 123 11223");
  41         return 0;
  42 }
  43
  44 // Works for 26bits.
  45 int GetGuardBits(uint8_t fmtlen, uint32_t fc, uint32_t cn, uint8_t *guardBits) {
  46
  47         uint8_t xorKey = 0x66;
  48         uint8_t i;
  49         uint8_t pre[96];
  50         uint8_t rawbytes[12];
  51         memset(pre, 0x00, sizeof(pre));
  52         memset(rawbytes, 0x00, sizeof(rawbytes));
  53
  54         // add format length (decimal)
  55         switch (fmtlen) {
  56                 case 32: {
  57                         rawbytes[1] = (32 << 2);
  58
  59                         break;
  60                 }
  61                 case 36: {
  62                         // FC = ((ByteStream[3] & 0x7F)<<7) | (ByteStream[4]>>1);
  63                         // Card = ((ByteStream[4]&1)<<19) | (ByteStream[5]<<11) | (ByteStream[6]<<3) | (ByteStream[7]>>5);
  64                         rawbytes[1] = (36 << 2);
  65                         // Get 26 wiegand from FacilityCode, CardNumber
  66                         uint8_t wiegand[34];
  67                         memset(wiegand, 0x00, sizeof(wiegand));
  68                         num_to_bytebits(fc, 8, wiegand);
  69                         num_to_bytebits(cn, 26, wiegand+8);
  70
  71                         // add wiegand parity bits (dest, source, len)
  72                         wiegand_add_parity(pre, wiegand, 34);
  73                         break;
  74                 }
  75                 case 40: {
  76                         rawbytes[1] = (40 << 2);
  77                         break;
  78                 }
  79                 case 26:
  80                 default: {
  81                         rawbytes[1] = (26 << 2);
  82                         // Get 26 wiegand from FacilityCode, CardNumber
  83                         uint8_t wiegand[24];
  84                         memset(wiegand, 0x00, sizeof(wiegand));
  85                         num_to_bytebits(fc, 8, wiegand);
  86                         num_to_bytebits(cn, 16, wiegand+8);
  87
  88                         // add wiegand parity bits (dest, source, len)
  89                         wiegand_add_parity(pre, wiegand, 24);
  90                         break;
  91                 }
  92         }
  93         // 2bit checksum, unknown today,
  94         // these two bits are the last ones of rawbyte[1], hence the LSHIFT above.
  95
  96
  97         // xor key
  98         rawbytes[0] = xorKey;
  99
 100         rawbytes[2] = 1;
 101         rawbytes[3] = 0;
 102
 103         // add wiegand to rawbytes
 104         for (i = 0; i < 4; ++i)
 105                 rawbytes[i+4] = bytebits_to_byte( pre + (i*8), 8);
 106
 107         if (g_debugMode) printf(" WIE | %s\n", sprint_hex(rawbytes, sizeof(rawbytes)));
 108
 109
 110         // XOR (only works on wiegand stuff)
 111         for (i = 1; i < 12; ++i)
 112                 rawbytes[i] ^= xorKey ;
 113
 114         if (g_debugMode) printf(" XOR | %s \n", sprint_hex(rawbytes, sizeof(rawbytes)));
 115
 116         // convert rawbytes to bits in pre
 117         for (i = 0; i < 12; ++i)
 118                 num_to_bytebitsLSBF( rawbytes[i], 8, pre + (i*8));
 119
 120         if (g_debugMode) printf("\n Raw | %s \n", sprint_hex(rawbytes, sizeof(rawbytes)));
 121         if (g_debugMode) printf(" Raw | %s\n", sprint_bin(pre, 64) );
 122
 123         // add spacer bit 0 every 4 bits, starting with index 0,
 124         // 12 bytes, 24 nibbles.  24+1 extra bites. 3bytes.  ie 9bytes | 1byte xorkey, 8bytes rawdata (64bits, should be enough for a 40bit wiegand)
 125         addParity(pre, guardBits+6, 64, 5, 3);
 126
 127         // preamble
 128         guardBits[0] = 1;
 129         guardBits[1] = 1;
 130         guardBits[2] = 1;
 131         guardBits[3] = 1;
 132         guardBits[4] = 1;
 133         guardBits[5] = 0;
 134
 135         if (g_debugMode) printf(" FIN | %s\n", sprint_bin(guardBits, 96) );
 136         return 1;
 137 }
 138
 139 int CmdGuardRead(const char *Cmd) {
 140         CmdLFRead("s");
 141         getSamples("12000", TRUE);
 142         return CmdG_Prox_II_Demod("");
 143 }
 144
 145 int CmdGuardClone(const char *Cmd) {
 146
 147         char cmdp = param_getchar(Cmd, 0);
 148         if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_guard_clone();
 149
 150         uint32_t facilitycode = 0, cardnumber = 0, fc = 0, cn = 0, fmtlen = 0;
 151         uint8_t i;
 152         uint8_t bs[96];
 153         memset(bs, 0x00, sizeof(bs));
 154
 155         //GuardProxII - compat mode, ASK/Biphase,  data rate 64, 3 data blocks
 156         uint32_t blocks[5] = {T55x7_MODULATION_BIPHASE | T55x7_BITRATE_RF_64 | 3 << T55x7_MAXBLOCK_SHIFT, 0, 0, 0, 0};
 157
 158         if (param_getchar(Cmd, 3) == 'Q' || param_getchar(Cmd, 3) == 'q')
 159                 //t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
 160                 blocks[0] = T5555_MODULATION_FSK2 | ((50-2)>>1) << T5555_BITRATE_SHIFT | 3 << T5555_MAXBLOCK_SHIFT;
 161
 162         if (sscanf(Cmd, "%u %u %u", &fmtlen, &fc, &cn ) != 2) return usage_lf_guard_clone();
 163
 164         fmtlen &= 0x7f;
 165         facilitycode = (fc & 0x000000FF);
 166         cardnumber = (cn & 0x0000FFFF);
 167
 168         if ( !GetGuardBits(fmtlen, facilitycode, cardnumber, bs)) {
 169                 PrintAndLog("Error with tag bitstream generation.");
 170                 return 1;
 171         }
 172
 173         blocks[1] = bytebits_to_byte(bs,32);
 174         blocks[2] = bytebits_to_byte(bs+32,32);
 175         blocks[3] = bytebits_to_byte(bs+64,32);
 176
 177         PrintAndLog("Preparing to clone Guardall to T55x7 with Facility Code: %u, Card Number: %u", facilitycode, cardnumber);
 178         PrintAndLog("Blk | Data ");
 179         PrintAndLog("----+------------");
 180         for ( i = 0; i<4; ++i )
 181                 PrintAndLog(" %02d | 0x%08x", i, blocks[i]);
 182
 183         UsbCommand resp;
 184         UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}};
 185
 186         for ( i = 0; i<4; ++i ) {
 187                 c.arg[0] = blocks[i];
 188                 c.arg[1] = i;
 189                 clearCommandBuffer();
 190                 SendCommand(&c);
 191                 if (!WaitForResponseTimeout(CMD_ACK, &resp, T55XX_WRITE_TIMEOUT)){
 192                         PrintAndLog("Error occurred, device did not respond during write operation.");
 193                         return -1;
 194                 }
 195         }
 196     return 0;
 197 }
 198
 199 int CmdGuardSim(const char *Cmd) {
 200
 201         char cmdp = param_getchar(Cmd, 0);
 202         if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_guard_sim();
 203
 204         uint32_t facilitycode = 0, cardnumber = 0, fc = 0, cn = 0, fmtlen = 0;
 205         uint8_t clock = 64, encoding = 2, separator = 0, invert = 0;
 206
 207         uint8_t bs[96];
 208         memset(bs, 0x00, sizeof(bs));
 209
 210         if (sscanf(Cmd, "%u %u %u", &fmtlen, &fc, &cn ) != 2) return usage_lf_guard_sim();
 211
 212         fmtlen &= 0x7F;
 213         facilitycode = (fc & 0x000000FF);
 214         cardnumber = (cn & 0x0000FFFF);
 215
 216         if ( !GetGuardBits(fmtlen, facilitycode, cardnumber, bs)) {
 217                 PrintAndLog("Error with tag bitstream generation.");
 218                 return 1;
 219         }
 220
 221         PrintAndLog("Simulating Guardall - Facility Code: %u, CardNumber: %u", facilitycode, cardnumber );
 222
 223         // Guard uses:  clk: 64, invert: 0, encoding: 2 (ASK Biphase)
 224         uint64_t arg1, arg2;
 225         arg1 = (clock << 8) | encoding;
 226         arg2 = (invert << 8) | separator;
 227
 228         uint8_t rawbytes[12];
 229         size_t size = sizeof(rawbytes);
 230         for (uint8_t i=0; i < size; ++i){
 231                 rawbytes[i] =  bytebits_to_byte( bs + (i*8), 8);
 232         }
 233
 234         UsbCommand c = {CMD_ASK_SIM_TAG, {arg1, arg2, size}};
 235         memcpy(c.d.asBytes, rawbytes, size );
 236         clearCommandBuffer();
 237         SendCommand(&c);
 238         return 0;
 239 }
 240
 241 static command_t CommandTable[] = {
 242     {"help",    CmdHelp,                1, "This help"},
 243         {"read",        CmdGuardRead,  0, "Attempt to read and extract tag data"},
 244         {"clone",       CmdGuardClone, 0, "<Facility-Code> <Card Number>  clone Guardall tag"},
 245         {"sim",         CmdGuardSim,   0, "<Facility-Code> <Card Number>  simulate Guardall tag"},
 246     {NULL, NULL, 0, NULL}
 247 };
 248
 249 int CmdLFGuard(const char *Cmd) {
 250         clearCommandBuffer();
 251     CmdsParse(CommandTable, Cmd);
 252     return 0;
 253 }
 254
 255 int CmdHelp(const char *Cmd) {
 256     CmdsHelp(CommandTable);
 257     return 0;
 258 }