1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2012 Roel Verdult
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // Low frequency Hitag support
9 //-----------------------------------------------------------------------------
15 //#include "proxusb.h"
16 #include "proxmark3.h"
18 #include "cmdparser.h"
25 static int CmdHelp(const char *Cmd
);
27 size_t nbytes(size_t nbits
) {
28 return (nbits
/8)+((nbits
%8)>0);
31 int CmdLFHitagList(const char *Cmd
)
34 GetFromBigBuf(got
,sizeof(got
),0);
35 WaitForResponse(CMD_ACK
,NULL
);
37 PrintAndLog("recorded activity:");
38 PrintAndLog(" ETU :nbits: who bytes");
39 PrintAndLog("---------+-----+----+-----------");
50 int timestamp
= *((uint32_t *)(got
+i
));
51 if (timestamp
& 0x80000000) {
52 timestamp
&= 0x7fffffff;
58 int parityBits
= *((uint32_t *)(got
+i
+4));
59 // 4 bytes of additional information...
60 // maximum of 32 additional parity bit information
63 // at each quarter bit period we can send power level (16 levels)
64 // or each half bit period in 256 levels.
67 int len
= nbytes(got
[i
+8]);
72 if (i
+ len
>= 1900) {
76 uint8_t *frame
= (got
+i
+9);
78 // Break and stick with current result if buffer was not completely full
79 if (frame
[0] == 0x44 && frame
[1] == 0x44 && frame
[3] == 0x44) { break; }
83 for (j
= 0; j
< len
; j
++) {
88 oddparity
^= (((frame
[j
] & 0xFF) >> k
) & 0x01);
91 //if((parityBits >> (len - j - 1)) & 0x01) {
92 if (isResponse
&& (oddparity
!= ((parityBits
>> (len
- j
- 1)) & 0x01))) {
93 sprintf(line
+(j
*4), "%02x! ", frame
[j
]);
96 sprintf(line
+(j
*4), "%02x ", frame
[j
]);
100 PrintAndLog(" +%7d: %3d: %s %s",
101 (prev
< 0 ? 0 : (timestamp
- prev
)),
103 (isResponse
? "TAG" : " "),
108 // fprintf(pf," +%7d: %3d: %s %s\n",
109 // (prev < 0 ? 0 : (timestamp - prev)),
111 // (isResponse ? "TAG" : " "),
123 int CmdLFHitagSnoop(const char *Cmd
) {
124 UsbCommand c
= {CMD_SNOOP_HITAG
};
129 int CmdLFHitagSim(const char *Cmd
) {
130 UsbCommand c
= {CMD_SIMULATE_HITAG
};
131 char filename
[256] = { 0x00 };
133 bool tag_mem_supplied
;
135 param_getstr(Cmd
,0,filename
);
137 if (strlen(filename
) > 0) {
138 if ((pf
= fopen(filename
,"rb+")) == NULL
) {
139 PrintAndLog("Error: Could not open file [%s]",filename
);
142 tag_mem_supplied
= true;
143 if (fread(c
.d
.asBytes
,48,1,pf
) == 0) {
144 PrintAndLog("Error: File reading error");
150 tag_mem_supplied
= false;
153 // Does the tag comes with memory
154 c
.arg
[0] = (uint32_t)tag_mem_supplied
;
160 int CmdLFHitagReader(const char *Cmd
) {
161 // UsbCommand c = {CMD_READER_HITAG};
163 // param_get32ex(Cmd,1,0,16);
164 UsbCommand c
= {CMD_READER_HITAG
};//, {param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16),param_get32ex(Cmd,3,0,16)}};
165 hitag_data
* htd
= (hitag_data
*)c
.d
.asBytes
;
166 hitag_function htf
= param_get32ex(Cmd
,0,0,10);
169 case RHT2F_PASSWORD
: {
170 num_to_bytes(param_get32ex(Cmd
,1,0,16),4,htd
->pwd
.password
);
172 case RHT2F_AUTHENTICATE
: {
173 num_to_bytes(param_get32ex(Cmd
,1,0,16),4,htd
->auth
.NrAr
);
174 num_to_bytes(param_get32ex(Cmd
,2,0,16),4,htd
->auth
.NrAr
+4);
177 num_to_bytes(param_get64ex(Cmd
,1,0,16),6,htd
->crypto
.key
);
178 // num_to_bytes(param_get32ex(Cmd,2,0,16),4,htd->auth.NrAr+4);
180 case RHT2F_TEST_AUTH_ATTEMPTS
: {
181 // No additional parameters needed
184 PrintAndLog("Error: unkown reader function %d",htf
);
185 PrintAndLog("Hitag reader functions");
186 PrintAndLog(" HitagS (0*)");
187 PrintAndLog(" Hitag1 (1*)");
188 PrintAndLog(" Hitag2 (2*)");
189 PrintAndLog(" 21 <password> (password mode)");
190 PrintAndLog(" 22 <nr> <ar> (authentication)");
191 PrintAndLog(" 23 <key> (authentication) key is in format: ISK high + ISK low");
192 PrintAndLog(" 25 (test recorded authentications)");
197 // Copy the hitag2 function into the first argument
200 // Send the command to the proxmark
204 WaitForResponse(CMD_ACK
,&resp
);
206 // Check the return status, stored in the first argument
207 if (resp
.arg
[0] == false) return 1;
209 uint32_t id
= bytes_to_num(resp
.d
.asBytes
,4);
213 sprintf(filename
,"%08x_%04x.ht2",id
,(rand() & 0xffff));
214 if ((pf
= fopen(filename
,"wb")) == NULL
) {
215 PrintAndLog("Error: Could not open file [%s]",filename
);
219 // Write the 48 tag memory bytes to file and finalize
220 fwrite(resp
.d
.asBytes
,1,48,pf
);
223 PrintAndLog("Succesfully saved tag memory to [%s]",filename
);
228 static command_t CommandTableHitag
[] =
230 {"help", CmdHelp
, 1, "This help"},
231 {"list", CmdLFHitagList
, 1, "List Hitag trace history"},
232 {"reader", CmdLFHitagReader
, 1, "Act like a Hitag Reader"},
233 {"sim", CmdLFHitagSim
, 1, "Simulate Hitag transponder"},
234 {"snoop", CmdLFHitagSnoop
, 1, "Eavesdrop Hitag communication"},
235 {NULL
, NULL
, 0, NULL
}
238 int CmdLFHitag(const char *Cmd
)
240 CmdsParse(CommandTableHitag
, Cmd
);
244 int CmdHelp(const char *Cmd
)
246 CmdsHelp(CommandTableHitag
);