1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // High frequency Legic commands
9 //-----------------------------------------------------------------------------
13 #include "proxmark3.h"
16 #include "cmdparser.h"
17 #include "cmdhflegic.h"
21 static int CmdHelp(const char *Cmd
);
23 int usage_legic_calccrc8(void){
24 PrintAndLog("Calculates the legic crc8 on the input hexbytes.");
25 PrintAndLog("There must be an even number of hexsymbols as input.");
26 PrintAndLog("Usage: hf legic crc8 <hexbytes>");
27 PrintAndLog("Options :");
28 PrintAndLog(" <hexbytes> : hex bytes in a string");
30 PrintAndLog("Sample : hf legic crc8 deadbeef1122");
35 * Output BigBuf and deobfuscate LEGIC RF tag data.
36 * This is based on information given in the talk held
37 * by Henryk Ploetz and Karsten Nohl at 26c3
39 int CmdLegicDecode(const char *Cmd
) {
47 uint8_t data_buf
[1200]; // receiver buffer
48 //char out_string[3076]; // just use big buffer - bad practice
51 // copy data from proxmark into buffer
52 GetFromBigBuf(data_buf
,sizeof(data_buf
),0);
53 WaitForResponse(CMD_ACK
,NULL
);
55 // Output CDF System area (9 bytes) plus remaining header area (12 bytes)
57 uint32_t calc_crc
= CRC8Legic(data_buf
, 4);
59 PrintAndLog("\nCDF: System Area");
61 PrintAndLog("MCD: %02x, MSN: %02x %02x %02x, MCC: %02x %s",
67 (calc_crc
== crc
) ? "OK":"Failed"
70 switch (data_buf
[5]&0x7f) {
72 strncpy(token_type
, "IAM",sizeof(token_type
));
75 strcpy(token_type
, "SAM");
78 strcpy(token_type
, "GAM");
81 strcpy(token_type
, "???");
85 stamp_len
= 0xfc - data_buf
[6];
87 PrintAndLog("DCF: %02x %02x, Token_Type=%s (OLE=%01u), Stamp_len=%02u",
91 (data_buf
[5]&0x80)>>7,
95 PrintAndLog("WRP=%02u, WRC=%01u, RD=%01u, raw=%02x, SSC=%02x",
97 (data_buf
[7]&0x70)>>4,
98 (data_buf
[7]&0x80)>>7,
103 PrintAndLog("Remaining Header Area");
104 PrintAndLog("%s", sprint_hex(data_buf
+9, 13));
105 PrintAndLog("\nADF: User Area");
108 for ( n
=0; n
<64; n
++ ) {
109 segment_len
= ((data_buf
[i
+1]^crc
)&0x0f) * 256 + (data_buf
[i
]^crc
);
110 segment_flag
= ((data_buf
[i
+1]^crc
)&0xf0)>>4;
112 wrp
= (data_buf
[i
+2]^crc
);
113 wrc
= ((data_buf
[i
+3]^crc
)&0x70)>>4;
115 PrintAndLog("Segment %02u: raw header=%02x %02x %02x %02x, flag=%01x (valid=%01u, last=%01u), len=%04u, WRP=%02u, WRC=%02u, RD=%01u, CRC=%02x",
122 (segment_flag
&0x4)>>2,
123 (segment_flag
&0x8)>>3,
127 ((data_buf
[i
+3]^crc
)&0x80)>>7,
134 PrintAndLog("WRC protected area:");
136 for ( k
=i
; k
< wrc
; k
++)
139 for ( k
=i
; k
< wrc
; k
+= 8)
140 PrintAndLog("%s", sprint_hex( data_buf
+k
, 8) );
146 PrintAndLog("Remaining write protected area:");
148 if ( data_buf
[k
] > 0) {
149 for (k
=i
; k
< (wrp
-wrc
); k
++)
153 for (k
=i
; k
< (wrp
-wrc
); k
++)
154 PrintAndLog("%s", sprint_hex( data_buf
+k
, 16) );
159 PrintAndLog("Card ID: %2X%02X%02X", data_buf
[i
-4]^crc
, data_buf
[i
-3]^crc
, data_buf
[i
-2]^crc
);
162 PrintAndLog("Remaining segment payload:");
164 if ( data_buf
[k
] > 0 ) {
165 for ( k
=i
; k
< (segment_len
- wrp
- 5); k
++)
169 for ( k
=i
; k
< (segment_len
- wrp
- 5); k
++)
170 PrintAndLog("%s", sprint_hex( data_buf
+k
, 16) );
172 // end with last segment
173 if (segment_flag
& 0x8) return 0;
179 int CmdLegicRFRead(const char *Cmd
) {
180 int byte_count
=0, offset
=0;
181 sscanf(Cmd
, "%i %i", &offset
, &byte_count
);
182 if(byte_count
== 0) byte_count
= -1;
183 if(byte_count
+ offset
> 1024) byte_count
= 1024 - offset
;
185 UsbCommand c
= {CMD_READER_LEGIC_RF
, {offset
, byte_count
, 0}};
186 clearCommandBuffer();
191 int CmdLegicLoad(const char *Cmd
) {
192 char filename
[FILE_PATH_SIZE
] = {0x00};
195 char cmdp
= param_getchar(Cmd
, 0);
196 if ( cmdp
== 'H' || cmdp
== 'h' || cmdp
== 0x00) {
197 PrintAndLog("It loads datasamples from the file `filename` to device memory");
198 PrintAndLog("Usage: hf legic load <file name>");
199 PrintAndLog(" sample: hf legic load filename");
204 if (len
> FILE_PATH_SIZE
) {
205 PrintAndLog("Filepath too long (was %s bytes), max allowed is %s ", len
, FILE_PATH_SIZE
);
208 memcpy(filename
, Cmd
, len
);
210 FILE *f
= fopen(filename
, "r");
212 PrintAndLog("couldn't open '%s'", Cmd
);
218 uint32_t data
[8] = {0x00};
220 while ( fgets(line
, sizeof(line
), f
) ) {
221 int res
= sscanf(line
, "%x %x %x %x %x %x %x %x",
222 &data
[0], &data
[1], &data
[2], &data
[3],
223 &data
[4], &data
[5], &data
[6], &data
[7]);
226 PrintAndLog("Error: could not read samples");
231 UsbCommand c
= { CMD_DOWNLOADED_SIM_SAMPLES_125K
, {offset
, 0, 0}};
232 memcpy(c
.d
.asBytes
, data
, 8);
233 clearCommandBuffer();
235 WaitForResponse(CMD_ACK
, NULL
);
239 PrintAndLog("loaded %u samples", offset
);
243 int CmdLegicSave(const char *Cmd
) {
244 int requested
= 1024;
247 char filename
[FILE_PATH_SIZE
];
248 uint8_t got
[1024] = {0x00};
250 sscanf(Cmd
, " %s %i %i", filename
, &requested
, &offset
);
252 /* If no length given save entire legic read buffer */
253 /* round up to nearest 8 bytes so the saved data can be used with legicload */
257 if (requested
% 8 != 0) {
258 int remainder
= requested
% 8;
259 requested
= requested
+ 8 - remainder
;
262 if (offset
+ requested
> sizeof(got
)) {
263 PrintAndLog("Tried to read past end of buffer, <bytes> + <offset> > 1024");
267 FILE *f
= fopen(filename
, "w");
269 PrintAndLog("couldn't open '%s'", Cmd
+1);
273 GetFromBigBuf(got
,requested
,offset
);
274 WaitForResponse(CMD_ACK
,NULL
);
276 for (int j
= 0; j
< requested
; j
+= 8) {
277 fprintf(f
, "%02x %02x %02x %02x %02x %02x %02x %02x\n",
288 if (delivered
>= requested
) break;
292 PrintAndLog("saved %u samples", delivered
);
296 int CmdLegicRfSim(const char *Cmd
) {
297 UsbCommand c
= {CMD_SIMULATE_TAG_LEGIC_RF
, {6,3,0}};
298 sscanf(Cmd
, " %"lli
" %"lli
" %"lli
, &c
.arg
[0], &c
.arg
[1], &c
.arg
[2]);
299 clearCommandBuffer();
304 int CmdLegicRfWrite(const char *Cmd
) {
305 UsbCommand c
= {CMD_WRITER_LEGIC_RF
};
306 int res
= sscanf(Cmd
, " 0x%"llx
" 0x%"llx
, &c
.arg
[0], &c
.arg
[1]);
308 PrintAndLog("Please specify the offset and length as two hex strings");
311 clearCommandBuffer();
316 int CmdLegicRfFill(const char *Cmd
) {
317 UsbCommand cmd
= {CMD_WRITER_LEGIC_RF
};
318 int res
= sscanf(Cmd
, " 0x%"llx
" 0x%"llx
" 0x%"llx
, &cmd
.arg
[0], &cmd
.arg
[1], &cmd
.arg
[2]);
320 PrintAndLog("Please specify the offset, length and value as two hex strings");
325 UsbCommand c
= {CMD_DOWNLOADED_SIM_SAMPLES_125K
, {0, 0, 0}};
326 for(i
= 0; i
< 48; i
++) {
327 c
.d
.asBytes
[i
] = cmd
.arg
[2];
330 for(i
= 0; i
< 22; i
++) {
333 WaitForResponse(CMD_ACK
,NULL
);
335 clearCommandBuffer();
341 int CmdLegicCalcCrc8(const char *Cmd
){
343 int len
= strlen(Cmd
);
344 if (len
& 1 ) return usage_legic_calccrc8();
346 uint8_t *data
= malloc(len
);
347 if ( data
== NULL
) return 1;
349 param_gethex(Cmd
, 0, data
, len
);
351 uint32_t checksum
= CRC8Legic(data
, len
/2);
352 PrintAndLog("Bytes: %s || CRC8: %X", sprint_hex(data
, len
/2), checksum
);
357 static command_t CommandTable
[] = {
358 {"help", CmdHelp
, 1, "This help"},
359 {"decode", CmdLegicDecode
, 0, "Display deobfuscated and decoded LEGIC RF tag data (use after hf legic reader)"},
360 {"read", CmdLegicRFRead
, 0, "[offset][length] -- read bytes from a LEGIC card"},
361 {"save", CmdLegicSave
, 0, "<filename> [<length>] -- Store samples"},
362 {"load", CmdLegicLoad
, 0, "<filename> -- Restore samples"},
363 {"sim", CmdLegicRfSim
, 0, "[phase drift [frame drift [req/resp drift]]] Start tag simulator (use after load or read)"},
364 {"write", CmdLegicRfWrite
,0, "<offset> <length> -- Write sample buffer (user after load or read)"},
365 {"fill", CmdLegicRfFill
, 0, "<offset> <length> <value> -- Fill/Write tag with constant value"},
366 {"crc8", CmdLegicCalcCrc8
, 1, "Calculate Legic CRC8 over given hexbytes"},
367 {NULL
, NULL
, 0, NULL
}
370 int CmdHFLegic(const char *Cmd
) {
371 clearCommandBuffer();
372 CmdsParse(CommandTable
, Cmd
);
376 int CmdHelp(const char *Cmd
) {
377 CmdsHelp(CommandTable
);