git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfawid.c

   1 //-----------------------------------------------------------------------------
   2 // Authored by Craig Young <cyoung@tripwire.com> based on cmdlfhid.c structure
   3 //
   4 // cmdlfhid.c is Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
   5 //
   6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   7 // at your option, any later version. See the LICENSE.txt file for the text of
   8 // the license.
   9 //-----------------------------------------------------------------------------
  10 // Low frequency AWID26 commands
  11 //-----------------------------------------------------------------------------
  12
  13 #include <stdio.h>      // sscanf
  14 #include "proxmark3.h"  // Definitions, USB controls, etc
  15 #include "ui.h"         // PrintAndLog
  16 #include "cmdparser.h"  // CmdsParse, CmdsHelp
  17 #include "cmdlfawid.h"  // AWID function declarations
  18 #include "lfdemod.h"    // parityTest
  19 #include "cmdmain.h"
  20 static int CmdHelp(const char *Cmd);
  21
  22 int usage_lf_awid_fskdemod(void) {
  23   PrintAndLog("Enables AWID26 compatible reader mode printing details of scanned AWID26 tags.");
  24   PrintAndLog("By default, values are printed and logged until the button is pressed or another USB command is issued.");
  25   PrintAndLog("If the ['1'] option is provided, reader mode is exited after reading a single AWID26 card.");
  26   PrintAndLog("");
  27   PrintAndLog("Usage:  lf awid fskdemod ['1']");
  28   PrintAndLog("Options :");
  29   PrintAndLog("  1 : (optional) stop after reading a single card");
  30   PrintAndLog("");
  31   PrintAndLog("   sample : lf awid fskdemod");
  32   PrintAndLog("          : lf awid fskdemod 1");
  33   return 0;
  34 }
  35
  36 int usage_lf_awid_sim(void) {
  37   PrintAndLog("Enables simulation of AWID26 card with specified facility-code and card number.");
  38   PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
  39   PrintAndLog("Per AWID26 format, the facility-code is 8-bit and the card number is 16-bit.  Larger values are truncated.");
  40   PrintAndLog("");
  41   PrintAndLog("Usage:  lf awid sim <Facility-Code> <Card-Number>");
  42   PrintAndLog("Options :");
  43   PrintAndLog("  <Facility-Code> :  8-bit value AWID facility code");
  44   PrintAndLog("  <Card Number>   : 16-bit value AWID card number");
  45   PrintAndLog("");
  46   PrintAndLog("sample   : lf awid sim 224 1337");
  47   return 0;
  48 }
  49
  50 int usage_lf_awid_clone(void) {
  51   PrintAndLog("Enables cloning of AWID26 card with specified facility-code and card number onto T55x7.");
  52   PrintAndLog("The T55x7 must be on the antenna when issuing this command.  T55x7 blocks are calculated and printed in the process.");
  53   PrintAndLog("Per AWID26 format, the facility-code is 8-bit and the card number is 16-bit.  Larger values are truncated.");
  54   PrintAndLog("");
  55   PrintAndLog("Usage:  lf awid clone <Facility-Code> <Card-Number>");
  56   PrintAndLog("Options :");
  57   PrintAndLog("  <Facility-Code> :  8-bit value AWID facility code");
  58   PrintAndLog("  <Card Number>   : 16-bit value AWID card number");
  59   PrintAndLog("");
  60   PrintAndLog("sample  : lf awid clone 224 1337");
  61   return 0;
  62 }
  63
  64 int CmdAWIDDemodFSK(const char *Cmd) {
  65   int findone = 0;
  66   if (Cmd[0] == 'h' || Cmd[0] == 'H') return usage_lf_awid_fskdemod();
  67
  68   if (Cmd[0] == '1') findone = 1;
  69
  70   UsbCommand c = {CMD_AWID_DEMOD_FSK, {findone, 0, 0}};
  71   clearCommandBuffer();
  72   SendCommand(&c);
  73   return 0;
  74 }
  75
  76 int getAWIDBits(unsigned int fc, unsigned int cn, uint8_t *AWIDBits)
  77 {
  78         //int i;
  79         uint32_t fcode = (fc & 0x000000FF);
  80         uint32_t cnum = (cn & 0x0000FFFF);
  81         uint32_t uBits = 0;
  82
  83         if (fcode != fc)
  84                 PrintAndLog("NOTE: Facility code truncated for AWID26 format (8-bit facility code)");
  85         if (cnum!=cn)
  86                 PrintAndLog("NOTE: Card number was truncated for AWID26 format (16-bit card number)");
  87
  88         uint8_t pre[] = {0x01, 0x1D, 0x80, 0x00,0x00,0x00,0x00, 0x11, 0x11, 0x11, 0x11, 0x11};
  89         memcpy(AWIDBits, pre , sizeof(pre));
  90
  91         // AWIDBits[0] = 0x01; // 6-bit Preamble with 2 parity bits
  92         // AWIDBits[1] = 0x1D; // First byte from card format (26-bit) plus parity bits
  93         // AWIDBits[2] = 0x80; // Set the next two bits as 0b10 to finish card format
  94
  95         // for (i = 7; i<12; i++)
  96                 // AWIDBits[i]=0x11;
  97
  98         uBits = (fcode<<4) + (cnum>>12);
  99
 100         if (!parityTest(uBits,12,0)) AWIDBits[2] |= (1<<5); // If not already even parity, set bit to make even
 101
 102         uBits = AWIDBits[2]>>5;
 103
 104         if (!parityTest(uBits, 3, 1)) AWIDBits[2] |= (1<<4);
 105
 106         uBits = fcode>>5; // first 3 bits of facility-code
 107         AWIDBits[2] += (uBits<<1);
 108
 109         if (!parityTest(uBits, 3, 1)) AWIDBits[2]++; // Set parity bit to make odd parity
 110
 111         uBits = (fcode & 0x1C)>>2;
 112         AWIDBits[3] = 0;
 113
 114         if (!parityTest(uBits,3,1)) AWIDBits[3] |= (1<<4);
 115
 116         AWIDBits[3] += (uBits<<5);
 117         uBits = ((fcode & 0x3)<<1) + ((cnum & 0x8000)>>15); // Grab/shift 2 LSBs from facility code and add shifted MSB from cardnum
 118
 119         if (!parityTest(uBits,3,1))     AWIDBits[3]++; // Set LSB for parity
 120
 121         AWIDBits[3]+= (uBits<<1);
 122         uBits = (cnum & 0x7000)>>12;
 123         AWIDBits[4] = uBits<<5;
 124
 125         if (!parityTest(uBits,3,1))     AWIDBits[4] |= (1<<4);
 126
 127         uBits = (cnum & 0x0E00)>>9;
 128         AWIDBits[4] += (uBits<<1);
 129
 130         if (!parityTest(uBits,3,1))     AWIDBits[4]++; // Set LSB for parity
 131
 132         uBits = (cnum & 0x1C0)>>6; // Next bits from card number
 133         AWIDBits[5]=(uBits<<5);
 134
 135         if (!parityTest(uBits,3,1))     AWIDBits[5] |= (1<<4); // Set odd parity bit as needed
 136
 137         uBits = (cnum & 0x38)>>3;
 138         AWIDBits[5]+= (uBits<<1);
 139
 140         if (!parityTest(uBits,3,1))     AWIDBits[5]++; // Set odd parity bit as needed
 141
 142         uBits = (cnum & 0x7); // Last three bits from card number!
 143         AWIDBits[6] = (uBits<<5);
 144
 145         if (!parityTest(uBits,3,1))     AWIDBits[6] |= (1<<4);
 146
 147         uBits = (cnum & 0x0FFF);
 148
 149         if (!parityTest(uBits,12,1))
 150                 AWIDBits[6] |= (1<<3);
 151         else
 152                 AWIDBits[6]++;
 153
 154         return 1;
 155 }
 156
 157 int CmdAWIDSim(const char *Cmd)
 158 {
 159         uint32_t fcode = 0, cnum = 0, fc=0, cn=0, i=0;
 160         uint8_t bits[12];
 161         uint8_t *bs=bits;
 162
 163         uint64_t arg1 = (10<<8) + 8; // fcHigh = 10, fcLow = 8
 164         uint64_t arg2 = 50; // clk RF/50 invert=0
 165
 166         if (sscanf(Cmd, "%u %u", &fc, &cn ) != 2) return usage_lf_awid_sim();
 167
 168         fcode = (fc & 0x000000FF);
 169         cnum = (cn & 0x0000FFFF);
 170
 171         if (fc!=fcode) PrintAndLog("Facility-Code (%u) truncated to 8-bits: %u", fc, fcode);
 172         if (cn!=cnum)  PrintAndLog("Card number (%u) truncated to 16-bits: %u", cn, cnum);
 173
 174         PrintAndLog("Emulating AWID26 -- FC: %u; CN: %u\n", fcode, cnum);
 175         PrintAndLog("Press pm3-button to abort simulation or run another command");
 176
 177         if (!getAWIDBits(fc, cn, bs)) {
 178                 PrintAndLog("Error with tag bitstream generation.");
 179                 return 1;
 180         }
 181         // AWID uses: fcHigh: 10, fcLow: 8, clk: 50, invert: 0
 182         PrintAndLog("Running 'lf simfsk c 50 H 10 L 8 d %s'", sprint_hex(bs, sizeof(bs)));
 183
 184         // arg1 --- fcHigh<<8 + fcLow
 185         // arg2 --- Inversion and clk setting
 186         // 96   --- Bitstream length: 96-bits == 12 bytes
 187         UsbCommand c = {CMD_FSK_SIM_TAG, {arg1, arg2, 96}};
 188
 189         for (i=0; i < 96; i++)
 190                 c.d.asBytes[i] = (bs[i/8] & (1<<(7-(i%8)))) ? 1 : 0;
 191
 192         clearCommandBuffer();
 193         SendCommand(&c);
 194         return 0;
 195 }
 196
 197 int CmdAWIDClone(const char *Cmd)
 198 {
 199         uint32_t blocks[4] = {0x00107060, 0, 0, 0x11111111};
 200         uint32_t fc=0, cn=0, i=0;
 201         uint8_t bits[12];
 202         uint8_t *bs=bits;
 203
 204         if (sscanf(Cmd, "%u %u", &fc, &cn ) != 2) return usage_lf_awid_clone();
 205
 206         if ((fc & 0xFF) != fc) {
 207                 fc &= 0xFF;
 208                 PrintAndLog("Facility-Code Truncated to 8-bits (AWID26): %u", fc);
 209         }
 210
 211         if ((cn & 0xFFFF) != cn) {
 212                 cn &= 0xFFFF;
 213                 PrintAndLog("Card Number Truncated to 16-bits (AWID26): %u", cn);
 214         }
 215
 216         if ( !getAWIDBits(fc, cn, bs)) {
 217                 PrintAndLog("Error with tag bitstream generation.");
 218                 return 1;
 219         }
 220
 221         PrintAndLog("Preparing to clone AWID26 to T55x7 with FC: %u, CN: %u ", fc, cn);
 222         PrintAndLog("Raw: %s", sprint_hex(bs, sizeof(bs)));
 223
 224         blocks[1] = (bs[0]<<24) + (bs[1]<<16) + (bs[2]<<8) + (bs[3]);
 225         blocks[2] = (bs[4]<<24) + (bs[5]<<16) + (bs[6]<<8) + (bs[7]);
 226
 227         PrintAndLog("Blk | Data ");
 228         PrintAndLog("----+------------");
 229         PrintAndLog(" 00 | 0x%08x", blocks[0]);
 230         PrintAndLog(" 01 | 0x%08x", blocks[1]);
 231         PrintAndLog(" 02 | 0x%08x", blocks[2]);
 232         PrintAndLog(" 03 | 0x%08x", blocks[3]);
 233
 234         UsbCommand resp;
 235         UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}};
 236
 237         for (i=0; i<4; i++) {
 238                 c.arg[0] = blocks[i];
 239                 c.arg[1] = i;
 240                 clearCommandBuffer();
 241                 SendCommand(&c);
 242                 if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){
 243                         PrintAndLog("Error occurred, device did not respond during write operation.");
 244                         return -1;
 245                 }
 246         }
 247         return 0;
 248 }
 249
 250 static command_t CommandTable[] =
 251 {
 252         {"help",      CmdHelp,         1, "This help"},
 253         {"fskdemod",  CmdAWIDDemodFSK, 0, "['1'] Realtime AWID FSK demodulator (option '1' for one tag only)"},
 254         {"sim",       CmdAWIDSim,      0, "<Facility-Code> <Card Number> -- AWID tag simulator"},
 255         {"clone",     CmdAWIDClone,    0, "<Facility-Code> <Card Number> -- Clone AWID to T55x7 (tag must be in range of antenna)"},
 256         {NULL, NULL, 0, NULL}
 257 };
 258
 259 int CmdLFAWID(const char *Cmd)
 260 {
 261         CmdsParse(CommandTable, Cmd);
 262         return 0;
 263 }
 264
 265 int CmdHelp(const char *Cmd)
 266 {
 267         CmdsHelp(CommandTable);
 268         return 0;
 269 }