git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfpyramid.c

   1 //-----------------------------------------------------------------------------
   2 //
   3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   4 // at your option, any later version. See the LICENSE.txt file for the text of
   5 // the license.
   6 //-----------------------------------------------------------------------------
   7 // Low frequency Farpoint / Pyramid tag commands
   8 //-----------------------------------------------------------------------------
   9 #include <string.h>
  10 #include <inttypes.h>
  11 #include "cmdlfpyramid.h"
  12 #include "proxmark3.h"
  13 #include "ui.h"
  14 #include "util.h"
  15 #include "graph.h"
  16 #include "cmdparser.h"
  17 #include "cmddata.h"
  18 #include "cmdmain.h"
  19 #include "cmdlf.h"
  20 #include "protocols.h"  // for T55xx config register definitions
  21 #include "lfdemod.h"    // parityTest
  22 #include "crc.h"
  23
  24 static int CmdHelp(const char *Cmd);
  25
  26 int usage_lf_pyramid_clone(void){
  27         PrintAndLog("clone a Farpointe/Pyramid tag to a T55x7 tag.");
  28         PrintAndLog("The facility-code is 8-bit and the card number is 16-bit.  Larger values are truncated. ");
  29         PrintAndLog("Currently work only on 26bit");
  30         PrintAndLog("");
  31         PrintAndLog("Usage: lf pyramid clone <Facility-Code> <Card-Number>");
  32         PrintAndLog("Options :");
  33         PrintAndLog("  <Facility-Code> :  8-bit value facility code");
  34         PrintAndLog("  <Card Number>   : 16-bit value card number");
  35         PrintAndLog("  Q5              : optional - clone to Q5 (T5555) instead of T55x7 chip");
  36         PrintAndLog("");
  37         PrintAndLog("Sample  : lf pyramid clone 123 11223");
  38         return 0;
  39 }
  40
  41 int usage_lf_pyramid_sim(void) {
  42         PrintAndLog("Enables simulation of Farpointe/Pyramid card with specified card number.");
  43         PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
  44         PrintAndLog("The facility-code is 8-bit and the card number is 16-bit.  Larger values are truncated.");
  45         PrintAndLog("Currently work only on 26bit");
  46         PrintAndLog("");
  47         PrintAndLog("Usage:  lf pyramid sim <Card-Number>");
  48         PrintAndLog("Options :");
  49         PrintAndLog("  <Facility-Code> :  8-bit value facility code");
  50         PrintAndLog("  <Card Number>   : 16-bit value card number");
  51         PrintAndLog("");
  52         PrintAndLog("Sample  : lf pyramid sim 123 11223");
  53         return 0;
  54 }
  55
  56 // Works for 26bits.
  57 int GetPyramidBits(uint32_t fc, uint32_t cn, uint8_t *pyramidBits) {
  58
  59         uint8_t pre[128];
  60         memset(pre, 0x00, sizeof(pre));
  61
  62         // format start bit
  63         pre[79] = 1;
  64
  65         // Get 26 wiegand from FacilityCode, CardNumber
  66         uint8_t wiegand[24];
  67         memset(wiegand, 0x00, sizeof(wiegand));
  68         num_to_bytebits(fc, 8, wiegand);
  69         num_to_bytebits(cn, 16, wiegand+8);
  70
  71         // add wiegand parity bits (dest, source, len)
  72         wiegand_add_parity(pre+80, wiegand, 24);
  73
  74         // add paritybits       (bitsource, dest, sourcelen, paritylen, parityType (odd, even,)
  75         addParity(pre+8, pyramidBits+8, 102, 8, 1);
  76
  77         // add checksum
  78         uint8_t csBuff[13];
  79         for (uint8_t i = 0; i < 13; i++)
  80                 csBuff[i] = bytebits_to_byte(pyramidBits + 16 + (i*8), 8);
  81
  82         uint32_t crc = CRC8Maxim(csBuff, 13);
  83         num_to_bytebits(crc, 8, pyramidBits+120);
  84         return 1;
  85 }
  86
  87 int CmdPyramidRead(const char *Cmd) {
  88         CmdLFRead("s");
  89         getSamples("30000",false);
  90         return CmdFSKdemodPyramid("");
  91 }
  92
  93 int CmdPyramidClone(const char *Cmd) {
  94
  95         char cmdp = param_getchar(Cmd, 0);
  96         if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_pyramid_clone();
  97
  98         uint32_t facilitycode=0, cardnumber=0, fc = 0, cn = 0;
  99         uint32_t blocks[5];
 100         uint8_t i;
 101         uint8_t bs[128];
 102         memset(bs, 0x00, sizeof(bs));
 103
 104         if (sscanf(Cmd, "%u %u", &fc, &cn ) != 2) return usage_lf_pyramid_clone();
 105
 106         facilitycode = (fc & 0x000000FF);
 107         cardnumber = (cn & 0x0000FFFF);
 108
 109         if ( !GetPyramidBits(facilitycode, cardnumber, bs)) {
 110                 PrintAndLog("Error with tag bitstream generation.");
 111                 return 1;
 112         }
 113
 114         //Pyramid - compat mode, FSK2a, data rate 50, 4 data blocks
 115         blocks[0] = T55x7_MODULATION_FSK2a | T55x7_BITRATE_RF_50 | 4<<T55x7_MAXBLOCK_SHIFT;
 116
 117         if (param_getchar(Cmd, 3) == 'Q' || param_getchar(Cmd, 3) == 'q')
 118                 blocks[0] = T5555_MODULATION_FSK2 | T5555_INVERT_OUTPUT | 50<<T5555_BITRATE_SHIFT | 4<<T5555_MAXBLOCK_SHIFT;
 119
 120         blocks[1] = bytebits_to_byte(bs,32);
 121         blocks[2] = bytebits_to_byte(bs+32,32);
 122         blocks[3] = bytebits_to_byte(bs+64,32);
 123         blocks[4] = bytebits_to_byte(bs+96,32);
 124
 125         PrintAndLog("Preparing to clone Farpointe/Pyramid to T55x7 with Facility Code: %u, Card Number: %u", facilitycode, cardnumber);
 126         PrintAndLog("Blk | Data ");
 127         PrintAndLog("----+------------");
 128         for ( i = 0; i<5; ++i )
 129                 PrintAndLog(" %02d | %08" PRIx32, i, blocks[i]);
 130
 131         UsbCommand resp;
 132         UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}};
 133
 134         for ( i = 0; i<5; ++i ) {
 135                 c.arg[0] = blocks[i];
 136                 c.arg[1] = i;
 137                 clearCommandBuffer();
 138                 SendCommand(&c);
 139                 if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){
 140                         PrintAndLog("Error occurred, device did not respond during write operation.");
 141                         return -1;
 142                 }
 143         }
 144         return 0;
 145 }
 146
 147 int CmdPyramidSim(const char *Cmd) {
 148
 149         char cmdp = param_getchar(Cmd, 0);
 150         if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_pyramid_sim();
 151
 152         uint32_t facilitycode = 0, cardnumber = 0, fc = 0, cn = 0;
 153
 154         uint8_t bs[128];
 155         size_t size = sizeof(bs);
 156         memset(bs, 0x00, size);
 157
 158         // Pyramid uses:  fcHigh: 10, fcLow: 8, clk: 50, invert: 0
 159         uint64_t arg1, arg2;
 160         arg1 = (10 << 8) + 8;
 161         arg2 = 50 | 0;
 162
 163         if (sscanf(Cmd, "%u %u", &fc, &cn ) != 2) return usage_lf_pyramid_sim();
 164
 165         facilitycode = (fc & 0x000000FF);
 166         cardnumber = (cn & 0x0000FFFF);
 167
 168         if ( !GetPyramidBits(facilitycode, cardnumber, bs)) {
 169                 PrintAndLog("Error with tag bitstream generation.");
 170                 return 1;
 171         }
 172
 173         PrintAndLog("Simulating Farpointe/Pyramid - Facility Code: %u, CardNumber: %u", facilitycode, cardnumber );
 174
 175         UsbCommand c = {CMD_FSK_SIM_TAG, {arg1, arg2, size}};
 176         memcpy(c.d.asBytes, bs, size);
 177         clearCommandBuffer();
 178         SendCommand(&c);
 179         return 0;
 180 }
 181
 182 static command_t CommandTable[] = {
 183         {"help",  CmdHelp,         1, "This help"},
 184         {"read",  CmdPyramidRead,  0, "Attempt to read and extract tag data"},
 185         {"clone", CmdPyramidClone, 0, "<Facility-Code> <Card Number>  clone pyramid tag"},
 186         {"sim",   CmdPyramidSim,   0, "<Facility-Code> <Card Number>  simulate pyramid tag"},
 187         {NULL, NULL, 0, NULL}
 188 };
 189
 190 int CmdLFPyramid(const char *Cmd) {
 191         clearCommandBuffer();
 192         CmdsParse(CommandTable, Cmd);
 193         return 0;
 194 }
 195
 196 int CmdHelp(const char *Cmd) {
 197         CmdsHelp(CommandTable);
 198         return 0;
 199 }