]> git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfhid.c
3c0faf3e8e74d9344d7a6c86b307a32cbd9c6f07
[proxmark3-svn] / client / cmdlfhid.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // Low frequency HID commands
9 //-----------------------------------------------------------------------------
10
11 #include "cmdlfhid.h"
12
13 static int CmdHelp(const char *Cmd);
14
15 int usage_lf_hid_wiegand(void){
16 PrintAndLog("This command converts facility code/card number to Wiegand code");
17 PrintAndLog("Usage: lf hid wiegand [h] [OEM] [FC] [CN]");
18
19 PrintAndLog("Options:");
20 PrintAndLog(" h - This help");
21 PrintAndLog(" OEM - OEM number / site code");
22 PrintAndLog(" FC - facility code");
23 PrintAndLog(" CN - card number");
24 PrintAndLog("Examples:");
25 PrintAndLog(" lf hid wiegand 0 101 2001");
26 return 0;
27 }
28 int usage_lf_hid_sim(void){
29 PrintAndLog("HID Tag simulator");
30 PrintAndLog("");
31 PrintAndLog("Usage: lf hid sim [h] [ID]");
32 PrintAndLog("Options:");
33 PrintAndLog(" h - This help");
34 PrintAndLog(" ID - HID id");
35 PrintAndLog("Examples:");
36 PrintAndLog(" lf hid sim 224");
37 return 0;
38 }
39 int usage_lf_hid_clone(void){
40 PrintAndLog("Clone HID to T55x7. Tag must be on antenna. ");
41 PrintAndLog("");
42 PrintAndLog("Usage: lf hid clone [h] [ID] <L>");
43 PrintAndLog("Options:");
44 PrintAndLog(" h - This help");
45 PrintAndLog(" ID - HID id");
46 PrintAndLog(" L - 84bit ID");
47 PrintAndLog("Examples:");
48 PrintAndLog(" lf hid clone 224");
49 PrintAndLog(" lf hid clone 224 L");
50 return 0;
51 }
52 int usage_lf_hid_brute(void){
53 PrintAndLog("Enables bruteforce of HID readers with specified facility code.");
54 PrintAndLog("This is a attack against reader. if cardnumber is given, it starts with it and goes up / down one step");
55 PrintAndLog("if cardnumber is not given, it starts with 1 and goes up to 65535");
56 PrintAndLog("");
57 PrintAndLog("Usage: lf hid brute [h] a <format> f <facility-code> c <cardnumber> d <delay>");
58 PrintAndLog("Options :");
59 PrintAndLog(" h : This help");
60 PrintAndLog(" a <format> : 26|33|34|35|37|40|44|84");
61 PrintAndLog(" f <facility-code> : 8-bit value HID facility code");
62 PrintAndLog(" c <cardnumber> : (optional) cardnumber to start with, max 65535");
63 PrintAndLog(" d <delay> : delay betweens attempts in ms. Default 1000ms");
64 PrintAndLog("");
65 PrintAndLog("Samples:");
66 PrintAndLog(" lf hid brute a 26 f 224");
67 PrintAndLog(" lf hid brute a 26 f 21 d 2000");
68 PrintAndLog(" lf hid brute a 26 f 21 c 200 d 2000");
69 return 0;
70 }
71
72 static int sendPing(void){
73 UsbCommand ping = {CMD_PING, {1, 2, 3}};
74 SendCommand(&ping);
75 SendCommand(&ping);
76 SendCommand(&ping);
77 clearCommandBuffer();
78 UsbCommand resp;
79 if (WaitForResponseTimeout(CMD_ACK, &resp, 1000))
80 return 0;
81 return 1;
82 }
83 static bool sendTry(uint8_t fmtlen, uint32_t fc, uint32_t cn, uint32_t delay, uint8_t *bs){
84
85 PrintAndLog("Trying FC: %u; CN: %u", fc, cn);
86
87 calcWiegand( fmtlen, fc, cn, bs);
88
89 uint64_t arg1 = bytebits_to_byte(bs,32);
90 uint64_t arg2 = bytebits_to_byte(bs+32,32);
91 UsbCommand c = {CMD_HID_SIM_TAG, {arg1, arg2, 0}};
92 clearCommandBuffer();
93 SendCommand(&c);
94 msleep(delay);
95 sendPing();
96 return TRUE;
97 }
98
99 int CmdHIDDemodFSK(const char *Cmd) {
100 int findone = ( Cmd[0] == '1' ) ? 1 : 0;
101 UsbCommand c = {CMD_HID_DEMOD_FSK, {findone, 0 , 0}};
102 clearCommandBuffer();
103 SendCommand(&c);
104 return 0;
105 }
106
107 int CmdHIDSim(const char *Cmd) {
108 unsigned int hi = 0, lo = 0;
109 int n = 0, i = 0;
110
111 uint8_t ctmp = param_getchar(Cmd, 0);
112 if ( strlen(Cmd) == 0 || ctmp == 'H' || ctmp == 'h' ) return usage_lf_hid_sim();
113
114 while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
115 hi = (hi << 4) | (lo >> 28);
116 lo = (lo << 4) | (n & 0xf);
117 }
118
119 PrintAndLog("Emulating tag with ID %x%16x", hi, lo);
120 PrintAndLog("Press pm3-button to abort simulation");
121
122 UsbCommand c = {CMD_HID_SIM_TAG, {hi, lo, 0}};
123 clearCommandBuffer();
124 SendCommand(&c);
125 return 0;
126 }
127
128 int CmdHIDClone(const char *Cmd) {
129
130 uint32_t hi2 = 0, hi = 0, lo = 0;
131 int n = 0, i = 0;
132 UsbCommand c;
133
134 uint8_t ctmp = param_getchar(Cmd, 0);
135 if ( strlen(Cmd) == 0 || ctmp == 'H' || ctmp == 'h' ) return usage_lf_hid_clone();
136
137 if (strchr(Cmd,'l') != 0) {
138 while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
139 hi2 = (hi2 << 4) | (hi >> 28);
140 hi = (hi << 4) | (lo >> 28);
141 lo = (lo << 4) | (n & 0xf);
142 }
143
144 PrintAndLog("Cloning tag with long ID %x%08x%08x", hi2, hi, lo);
145
146 c.d.asBytes[0] = 1;
147 } else {
148 while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
149 hi = (hi << 4) | (lo >> 28);
150 lo = (lo << 4) | (n & 0xf);
151 }
152
153 PrintAndLog("Cloning tag with ID %x%08x", hi, lo);
154
155 hi2 = 0;
156 c.d.asBytes[0] = 0;
157 }
158
159 c.cmd = CMD_HID_CLONE_TAG;
160 c.arg[0] = hi2;
161 c.arg[1] = hi;
162 c.arg[2] = lo;
163
164 clearCommandBuffer();
165 SendCommand(&c);
166 return 0;
167 }
168 // struct to handle wiegand
169 typedef struct {
170 uint8_t FormatLen;
171 uint8_t SiteCode;
172 uint8_t FacilityCode;
173 uint8_t CardNumber;
174 uint8_t* Wiegand;
175 size_t Wiegand_n;
176 } wiegand_t;
177
178 static void addHIDMarker(uint8_t fmtlen, uint8_t *out) {
179 switch(fmtlen) {
180 case 26:{
181 uint8_t len = 37;
182 uint8_t tmp[len];
183 memset(tmp, 0, len);
184 uint8_t idx = 37-fmtlen;
185 memcpy(tmp+idx, out, fmtlen);
186 tmp[idx] = 1; // start sentinel?
187 tmp[0] = 1; // bit indicates that a format smaller than 37 is used
188 memcpy(out, tmp, len);
189 break;
190 }
191 case 34:
192 // set bit format for less than 37 bit format
193 // 5+32= 1
194 //*hi = (1 << 5) | (fc >> 15);
195 break;
196 default:break;
197 }
198 }
199
200 // static void getParity34(uint32_t *hi, uint32_t *lo){
201 // uint32_t result = 0;
202 // int i;
203
204 // // even parity
205 // for (i = 7;i >= 0;i--)
206 // result ^= (*hi >> i) & i;
207 // for (i = 31;i >= 24;i--)
208 // result ^= (*lo >> i) & 1;
209
210 // *hi |= result << 2;
211
212 // // odd parity bit
213 // result = 0;
214 // for (i = 23;i >= 1;i--)
215 // result ^= (*lo >> i) & 1;
216
217 // *lo |= !result;
218 // }
219 // static void getParity37H(uint32_t *hi, uint32_t *lo){
220 // uint32_t result = 0;
221 // int i;
222
223 // // even parity
224 // for (i = 4;i >= 0;i--)
225 // result ^= (*hi >> i) & 1;
226 // for (i = 31;i >= 20;i--)
227 // result ^= (*lo >> i) & 1;
228 // *hi |= result << 4;
229
230 // // odd parity
231 // result = 0;
232 // for (i = 19;i >= 1;i--)
233 // result ^= (*lo >> i) & 1;
234 // *lo |= result;
235 // }
236
237 //static void calc26(uint16_t fc, uint32_t cardno, uint8_t *out){
238 static void calc26(uint16_t fc, uint32_t cardno, uint8_t *out){
239 uint8_t wiegand[24];
240 num_to_bytebits(fc, 8, wiegand);
241 num_to_bytebits(cardno, 16, wiegand+8);
242 wiegand_add_parity(out, wiegand, sizeof(wiegand) );
243 }
244 // static void calc33(uint16_t fc, uint32_t cardno, uint8_t *out){
245 // }
246 static void calc34(uint16_t fc, uint32_t cardno, uint8_t *out){
247 uint8_t wiegand[32];
248 num_to_bytebits(fc, 16, wiegand);
249 num_to_bytebits(cardno, 16, wiegand + 16);
250 wiegand_add_parity(out, wiegand, sizeof(wiegand) );
251 }
252 // static void calc35(uint16_t fc, uint32_t cardno, uint8_t *out){
253 // *lo = ((cardno & 0xFFFFF) << 1) | fc << 21;
254 // *hi = (1 << 5) | ((fc >> 11) & 1);
255 // }
256 static void calc37S(uint16_t fc, uint32_t cardno, uint8_t *out){
257 // FC 2 - 17 - 16 bit
258 // cardno 18 - 36 - 19 bit
259 // Even P1 1 - 19
260 // Odd P37 19 - 36
261 uint8_t wiegand[35];
262 num_to_bytebits(fc, 16, wiegand);
263 num_to_bytebits(cardno, 19, wiegand + 16);
264 wiegand_add_parity(out, wiegand, sizeof(wiegand) );
265 }
266 static void calc37H(uint64_t cardno, uint8_t *out){
267 // SC NONE
268 // cardno 1-35 34 bits
269 // Even Parity 0th bit 1-18
270 // Odd Parity 36th bit 19-35
271 uint8_t wiegand[37];
272 num_to_bytebits( (uint32_t)(cardno >> 32), 2, wiegand);
273 num_to_bytebits( (uint32_t)(cardno >> 0), 32, wiegand + 2);
274 wiegand_add_parity(out, wiegand, sizeof(wiegand) );
275
276 printf("%x %x\n", (uint32_t)(cardno >> 32), (uint32_t)cardno );
277 }
278 // static void calc40(uint64_t cardno, uint8_t *out){
279 // cardno = (cardno & 0xFFFFFFFFFF);
280 // *lo = ((cardno & 0xFFFFFFFF) << 1 );
281 // *hi = (cardno >> 31);
282 // }
283
284 void calcWiegand(uint8_t fmtlen, uint16_t fc, uint64_t cardno, uint8_t *bits){
285 uint32_t cn32 = (cardno & 0xFFFFFFFF);
286 switch ( fmtlen ) {
287 case 26: calc26(fc, cn32, bits); break;
288 // case 33 : calc33(fc, cn32, bits); break;
289 case 34: calc34(fc, cn32, bits); break;
290 // case 35 : calc35(fc, cn32, bits); break;
291 case 37: calc37S(fc, cn32, bits); break;
292 case 38: calc37H(cardno, bits); break;
293 // case 40 : calc40(cardno, bits); break;
294 // case 44 : { break; }
295 // case 84 : { break; }
296 default: break;
297 }
298 }
299
300 int CmdHIDWiegand(const char *Cmd) {
301 uint32_t oem = 0, fc = 0;
302 uint64_t cardnum = 0;
303 uint64_t blocks = 0, wiegand = 0;
304
305 uint8_t bits[96];
306 uint8_t *bs = bits;
307 memset(bs, 0, sizeof(bits));
308
309 uint8_t ctmp = param_getchar(Cmd, 0);
310 if ( strlen(Cmd) == 0 || strlen(Cmd) < 3 || ctmp == 'H' || ctmp == 'h' ) return usage_lf_hid_wiegand();
311
312 oem = param_get8(Cmd, 0);
313 fc = param_get32ex(Cmd, 1, 0, 10);
314 cardnum = param_get64ex(Cmd, 2, 0, 10);
315
316 uint8_t fmtlen[] = {26,33,34,35,37,38,40};
317
318 PrintAndLog("HID | OEM | FC | CN | Wiegand | HID Formatted");
319 PrintAndLog("----+-----+------+---------+-----------+--------------------");
320 for (uint8_t i = 0; i < sizeof(fmtlen); i++){
321 memset(bits, 0x00, sizeof(bits));
322 calcWiegand( fmtlen[i], fc, cardnum, bs);
323 printf("ice:: %s", sprint_bin(bs, fmtlen[i]));
324 wiegand = (uint64_t)bytebits_to_byte(bs, 32) << 32 | bytebits_to_byte(bs+32, 32);
325
326 addHIDMarker(fmtlen[i], bs);
327 printf("ice:: %s", sprint_bin(bs, 37));
328 blocks = (uint64_t)bytebits_to_byte(bs, 32) << 32 | bytebits_to_byte(bs+32, 32);
329 uint8_t shifts = 64-fmtlen[i];
330 wiegand >>= shifts;
331
332 PrintAndLog(" %u | %03u | %03u | %llu | %llX | %llX",
333 fmtlen[i],
334 oem,
335 fc,
336 cardnum,
337 wiegand,
338 blocks
339 );
340 }
341 PrintAndLog("----+-----+-----+-------+-----------+--------------------");
342 return 0;
343 }
344
345 int CmdHIDBrute(const char *Cmd){
346
347 bool errors = false;
348 uint32_t fc = 0, cn = 0, delay = 1000;
349 uint8_t fmtlen = 0;
350 uint8_t bits[96];
351 uint8_t *bs = bits;
352 memset(bs, 0, sizeof(bits));
353 uint8_t cmdp = 0;
354
355 while(param_getchar(Cmd, cmdp) != 0x00 && !errors) {
356 switch(param_getchar(Cmd, cmdp)) {
357 case 'h':
358 case 'H':
359 return usage_lf_hid_brute();
360 case 'f':
361 case 'F':
362 fc = param_get32ex(Cmd ,cmdp+1, 0, 10);
363 if ( !fc )
364 errors = true;
365 cmdp += 2;
366 break;
367 case 'd':
368 case 'D':
369 // delay between attemps, defaults to 1000ms.
370 delay = param_get32ex(Cmd, cmdp+1, 1000, 10);
371 cmdp += 2;
372 break;
373 case 'c':
374 case 'C':
375 cn = param_get32ex(Cmd, cmdp+1, 0, 10);
376 // truncate cardnumber.
377 cn &= 0xFFFF;
378 cmdp += 2;
379 break;
380 case 'a':
381 case 'A':
382 fmtlen = param_get8(Cmd, cmdp+1);
383 cmdp += 2;
384 bool is_ftm_ok = FALSE;
385 uint8_t ftms[] = {26,33,34,35,37};
386 for ( uint8_t i = 0; i < sizeof(ftms); i++){
387 if ( ftms[i] == fmtlen ) {
388 is_ftm_ok = TRUE;
389 }
390 }
391 // negated
392 errors = !is_ftm_ok;
393 break;
394 default:
395 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
396 errors = true;
397 break;
398 }
399 }
400 if ( fc == 0 ) errors = true;
401 if ( errors ) return usage_lf_hid_brute();
402
403 PrintAndLog("Brute-forcing HID reader");
404 PrintAndLog("Press pm3-button to abort simulation or run another command");
405
406 uint16_t up = cn;
407 uint16_t down = cn;
408
409 for (;;){
410
411 if ( offline ) {
412 printf("Device offline\n");
413 return 2;
414 }
415
416 if (ukbhit()) {
417 PrintAndLog("aborted via keyboard!");
418 return sendPing();
419 }
420
421 // Do one up
422 if ( up < 0xFFFF )
423 if ( !sendTry(fmtlen, fc, up++, delay, bs)) return 1;
424
425 // Do one down (if cardnumber is given)
426 if ( cn > 1 )
427 if ( down > 1 )
428 if ( !sendTry(fmtlen, fc, --down, delay, bs)) return 1;
429 }
430 return 0;
431 }
432
433 static command_t CommandTable[] = {
434 {"help", CmdHelp, 1, "This help"},
435 {"fskdemod",CmdHIDDemodFSK, 0, "Realtime HID FSK demodulator"},
436 {"sim", CmdHIDSim, 0, "HID tag simulator"},
437 {"clone", CmdHIDClone, 0, "Clone HID to T55x7"},
438 {"wiegand", CmdHIDWiegand, 1, "Convert facility code/card number to Wiegand code"},
439 {"brute", CmdHIDBrute, 0, "Bruteforce card number against reader"},
440 {NULL, NULL, 0, NULL}
441 };
442
443 int CmdLFHID(const char *Cmd) {
444 clearCommandBuffer();
445 CmdsParse(CommandTable, Cmd);
446 return 0;
447 }
448
449 int CmdHelp(const char *Cmd) {
450 CmdsHelp(CommandTable);
451 return 0;
452 }
Impressum, Datenschutz