git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfhid.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // Low frequency HID commands
   9 //-----------------------------------------------------------------------------
  10
  11 #include <stdio.h>
  12 #include <string.h>
  13 #include "proxmark3.h"
  14 #include "ui.h"
  15 #include "graph.h"
  16 #include "cmdparser.h"
  17 #include "cmdlfhid.h"
  18 #include "util.h"
  19 #include "cmdmain.h"
  20 #include "sleep.h"
  21
  22 static int CmdHelp(const char *Cmd);
  23
  24 int usage_lf_hid_wiegand(void){
  25         PrintAndLog("Usage: lf hid wiegand [h] [OEM] [FC] [CN]");
  26         PrintAndLog("This command converts facility code/card number to Wiegand code");
  27         PrintAndLog("Options:");
  28         PrintAndLog("       h             - This help");
  29         PrintAndLog("       OEM           - OEM number");
  30         PrintAndLog("       FC            - facility code");
  31         PrintAndLog("       CN            - card number");
  32         PrintAndLog("Examples:");
  33         PrintAndLog("      lf hid wiegand 0 101 2001");
  34         return 0;
  35 }
  36 int usage_lf_hid_brute(void){
  37         PrintAndLog("Enables bruteforce of HID readers with specified facility code.");
  38         PrintAndLog("Different formatlength is supported");
  39         PrintAndLog("This is a incremental attack against reader.");
  40         PrintAndLog("");
  41         PrintAndLog("Usage:  lf hid brute <format length> <facility code>");
  42         PrintAndLog("Options :");
  43         PrintAndLog("  <format length>  - 26|33|34|35|37|40|44|84");
  44         PrintAndLog("  <facility code>  - 8-bit value HID facility code");
  45         PrintAndLog("");
  46         PrintAndLog("Sample  : lf hid brute 26 224");
  47         return 0;
  48 }
  49 /*
  50 int CmdHIDDemod(const char *Cmd)
  51 {
  52   if (GraphTraceLen < 4800) {
  53     PrintAndLog("too short; need at least 4800 samples");
  54     return 0;
  55   }
  56
  57   GraphTraceLen = 4800;
  58   for (int i = 0; i < GraphTraceLen; ++i) {
  59     if (GraphBuffer[i] < 0) {
  60       GraphBuffer[i] = 0;
  61     } else {
  62       GraphBuffer[i] = 1;
  63     }
  64   }
  65   RepaintGraphWindow();
  66   return 0;
  67 }
  68 */
  69 int CmdHIDDemodFSK(const char *Cmd) {
  70         int findone = ( Cmd[0] == '1' ) ? 1 : 0;
  71         UsbCommand c = {CMD_HID_DEMOD_FSK, {findone, 0 , 0}};
  72         clearCommandBuffer();
  73         SendCommand(&c);
  74         return 0;
  75 }
  76
  77 int CmdHIDSim(const char *Cmd) {
  78         unsigned int hi = 0, lo = 0;
  79         int n = 0, i = 0;
  80
  81         while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
  82                 hi = (hi << 4) | (lo >> 28);
  83                 lo = (lo << 4) | (n & 0xf);
  84         }
  85
  86         PrintAndLog("Emulating tag with ID %x%16x", hi, lo);
  87         PrintAndLog("Press pm3-button to abort simulation");
  88
  89         UsbCommand c = {CMD_HID_SIM_TAG, {hi, lo, 0}};
  90         clearCommandBuffer();
  91         SendCommand(&c);
  92         return 0;
  93 }
  94
  95 int CmdHIDClone(const char *Cmd) {
  96         unsigned int hi2 = 0, hi = 0, lo = 0;
  97         int n = 0, i = 0;
  98         UsbCommand c;
  99
 100         if (strchr(Cmd,'l') != 0) {
 101                 while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
 102                         hi2 = (hi2 << 4) | (hi >> 28);
 103                         hi = (hi << 4) | (lo >> 28);
 104                         lo = (lo << 4) | (n & 0xf);
 105                 }
 106
 107                 PrintAndLog("Cloning tag with long ID %x%08x%08x", hi2, hi, lo);
 108
 109                 c.d.asBytes[0] = 1;
 110         } else {
 111                 while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
 112                         hi = (hi << 4) | (lo >> 28);
 113                         lo = (lo << 4) | (n & 0xf);
 114                 }
 115
 116                 PrintAndLog("Cloning tag with ID %x%08x", hi, lo);
 117
 118                 hi2 = 0;
 119                 c.d.asBytes[0] = 0;
 120         }
 121
 122         c.cmd = CMD_HID_CLONE_TAG;
 123         c.arg[0] = hi2;
 124         c.arg[1] = hi;
 125         c.arg[2] = lo;
 126
 127         clearCommandBuffer();
 128         SendCommand(&c);
 129         return 0;
 130 }
 131
 132 static void getParity26(uint32_t *hi, uint32_t *lo){
 133         uint32_t result = 0;
 134         int i;
 135         // even parity
 136         for (i = 24;i >= 13;i--)
 137                 result ^= (*lo >> i) & 1;
 138         // even parity 26th bit
 139         *lo |= result << 25;
 140
 141         // odd parity
 142         result = 0;
 143         for (i = 12;i >= 1;i--)
 144                 result ^= (*lo >> i) & 1;
 145         *lo |= !result;
 146 }
 147 static void getParity33(uint32_t *hi, uint32_t *lo){
 148
 149 }
 150 static void getParity34(uint32_t *hi, uint32_t *lo){
 151         uint32_t result = 0;
 152         int i;
 153
 154         // even parity
 155         for (i = 7;i >= 0;i--)
 156                 result ^= (*hi >> i) & i;
 157         for (i = 31;i >= 24;i--)
 158                 result ^= (*lo >> i) & 1;
 159
 160         *hi |= result << 2;
 161
 162         // odd parity bit
 163         result = 0;
 164         for (i = 23;i >= 1;i--)
 165                 result ^= (*lo >> i) & 1;
 166
 167         *lo |= !result;
 168 }
 169 static void getParity35(uint32_t *hi, uint32_t *lo){
 170 }
 171 static void getParity37S(uint32_t *hi,uint32_t *lo){
 172         uint32_t result = 0;
 173         int i;
 174
 175         // even parity
 176         for (i = 4; i >= 0; i--)
 177                 result ^= (*hi >> i) & 1;
 178
 179         for (i = 31; i >= 20; i--)
 180                 result ^= (*lo >> i) & 1;
 181
 182         *hi |= result;
 183
 184         // odd parity
 185         result = 0;
 186         for (i = 19; i >= 1; i--)
 187                 result ^= (*lo >> i) & 1;
 188
 189         *lo |= result;
 190 }
 191 static void getParity37H(uint32_t *hi, uint32_t *lo){
 192         uint32_t result = 0;
 193         int i;
 194
 195         // even parity
 196         for (i = 4;i >= 0;i--)
 197                 result ^= (*hi >> i) & 1;
 198         for (i = 31;i >= 20;i--)
 199                 result ^= (*lo >> i) & 1;
 200         *hi |= result << 4;
 201
 202         // odd parity
 203         result = 0;
 204         for (i = 19;i >= 1;i--)
 205                 result ^= (*lo >> i) & 1;
 206         *lo |= result;
 207 }
 208
 209 static void calc26(uint16_t fc, uint32_t cardno, uint32_t *hi, uint32_t *lo){
 210    *lo = ((cardno & 0xFFFF) << 1) | ((fc & 0xFF) << 17) | (1 << 26);
 211    *hi = (1 << 5);
 212 }
 213 static void calc33(uint16_t fc, uint32_t cardno, uint32_t *hi, uint32_t *lo){
 214
 215 }
 216 static void calc34(uint16_t fc, uint32_t cardno, uint32_t *hi, uint32_t *lo){
 217   // put card number first bit 1 .. 20 //
 218   *lo = ((cardno & 0X000F7FFF) << 1) | ((fc & 0XFFFF) << 17);
 219   // set bit format for less than 37 bit format
 220   *hi = (1 << 5) | (fc >> 15);
 221 }
 222 static void calc35(uint16_t fc, uint32_t cardno, uint32_t *hi, uint32_t *lo){
 223         *lo = ((cardno & 0xFFFFF) << 1) | fc << 21;
 224         *hi = (1 << 5) | ((fc >> 11) & 1);
 225 }
 226 static void calc37S(uint16_t fc, uint32_t cardno, uint32_t *hi, uint32_t *lo){
 227         // FC 2 - 17   - 16 bit
 228         // cardno 18 - 36  - 19 bit
 229         // Even P1   1 - 19
 230         // Odd  P37  19 - 36
 231
 232         fc = fc & 0xFFFF;
 233         *lo = ((fc << 20) | (cardno & 0x7FFFF) << 1);
 234         *hi = (fc >> 12);
 235 }
 236 static void calc37H(uint64_t cardno, uint32_t *hi, uint32_t *lo){
 237         // SC NONE
 238         // cardno 1-35 34 bits
 239         // Even Parity  0th bit  1-18
 240         // Odd  Parity 36th bit 19-35
 241         cardno = (cardno & 0x00000003FFFFFFFF);
 242         *lo = (cardno << 1);
 243         *hi = (cardno >> 31);
 244 }
 245 static void calc40(uint64_t cardno, uint32_t *hi, uint32_t *lo){
 246         cardno = (cardno & 0xFFFFFFFFFF);
 247         *lo = ((cardno & 0xFFFFFFFF) << 1 );
 248         *hi = (cardno >> 31);
 249 }
 250
 251 static void calcWiegand(uint8_t fmtlen, uint16_t fc, uint64_t cardno, uint32_t *hi, uint32_t *lo){
 252
 253         uint32_t cn = (cardno & 0xFFFFFFFF);
 254         switch ( fmtlen ) {
 255                 case 26 : {
 256                         calc26(fc, cn, hi, lo);
 257                         getParity26(hi, lo);
 258                         break;
 259                 }
 260                 case 33 : {
 261                         calc33(fc, cn, hi, lo);
 262                         getParity33(hi, lo);
 263                         break;
 264                 }
 265                 case 34 : {
 266                         calc34(fc, cn, hi, lo);
 267                         getParity34(hi, lo);
 268                         break;
 269                 }
 270                 case 35 : {
 271                         calc35(fc, cn, hi, lo);
 272                         getParity35(hi, lo);
 273                         break;
 274                 }
 275                 case 37 : {
 276                         calc37S(fc, cn, hi, lo);
 277                         getParity37S(hi, lo);
 278                         break;
 279                 }
 280                 case 38 : {
 281                         calc37H(cn, hi, lo);
 282                         getParity37H(hi, lo);
 283                         break;
 284                 }
 285                 case 40 : calc40(cardno, hi, lo);       break;
 286                 case 44 : { break; }
 287                 case 84 : { break; }
 288         }
 289 }
 290
 291 int CmdHIDWiegand(const char *Cmd) {
 292         uint32_t oem;
 293         uint32_t fc, lo = 0, hi = 0;
 294         uint64_t cardnum = 0;
 295
 296         uint8_t ctmp = param_getchar(Cmd, 0);
 297         if ( strlen(Cmd) == 0 || strlen(Cmd) < 3 || ctmp == 'H' || ctmp == 'h' ) return usage_lf_hid_wiegand();
 298
 299         oem = param_get8(Cmd, 0);
 300         fc = param_get32ex(Cmd, 1, 0, 10);
 301         cardnum = param_get64ex(Cmd, 2, 0, 10);
 302
 303         uint8_t ftmlen[] = {26,33,34,35,37,38,40};
 304         for (uint8_t i = 0; i < sizeof(ftmlen); i++){
 305                 calcWiegand( ftmlen[i], fc, cardnum, &hi, &lo);
 306                 PrintAndLog("HID %d bit | OEM: %d FC: %d CN: %llu | Wiegand code: %08X%08X", ftmlen[i], oem, fc, cardnum, hi, lo);
 307         }
 308         return 0;
 309 }
 310
 311 int CmdHIDBrute(const char *Cmd){
 312
 313         bool error = TRUE;
 314         uint8_t fc = 0, fmtlen = 0;
 315         uint32_t hi = 0, lo = 0;
 316
 317         UsbCommand c = {CMD_HID_SIM_TAG, {0, 0, 0}};
 318
 319         char cmdp = param_getchar(Cmd, 0);
 320         if (strlen(Cmd) > 2 || strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_hid_brute();
 321
 322         fmtlen = param_get8(Cmd, 0);
 323         uint8_t ftms[] = {26,33,34,35,37};
 324         for ( uint8_t i = 0; i < sizeof(ftms); i++){
 325                 if ( ftms[i] == fmtlen ) {
 326                         error = FALSE;
 327                 }
 328         }
 329
 330         if ( error ) return usage_lf_hid_brute();
 331
 332         fc =  param_get8(Cmd, 1);
 333         if ( fc == 0) return usage_lf_hid_brute();
 334
 335         PrintAndLog("Brute-forcing HID reader");
 336         PrintAndLog("Press pm3-button to abort simulation or run another command");
 337
 338         for ( uint16_t cn = 1; cn < 0xFFFF; ++cn){
 339                 if (ukbhit()) {
 340                         PrintAndLog("aborted via keyboard!");
 341                         c.cmd = CMD_PING;
 342                         c.arg[0] = 0x00;
 343                         c.arg[1] = 0x00;
 344                         c.arg[2] = 0x00;
 345                         clearCommandBuffer();
 346                         SendCommand(&c);
 347                         return 1;
 348                 }
 349
 350                 calcWiegand( fmtlen, fc, cn, &hi, &lo);
 351
 352                 c.arg[0] = hi;
 353                 c.arg[1] = lo;
 354                 clearCommandBuffer();
 355                 SendCommand(&c);
 356
 357                 PrintAndLog("Trying FC: %u; CN: %u", fc, cn);
 358                 // pause
 359                 sleep(1);
 360         }
 361         return 0;
 362 }
 363
 364 static command_t CommandTable[] = {
 365         {"help",    CmdHelp,        1, "This help"},
 366 //      {"demod",   CmdHIDDemod,    1, "Demodulate HID Prox Card II (not optimal)"},
 367         {"fskdemod",CmdHIDDemodFSK, 0, "['1'] Realtime HID FSK demodulator (option '1' for one tag only)"},
 368         {"sim",     CmdHIDSim,      0, "<ID> -- HID tag simulator"},
 369         {"clone",   CmdHIDClone,    0, "<ID> ['l'] -- Clone HID to T55x7 (tag must be in antenna)(option 'l' for 84bit ID)"},
 370         {"wiegand", CmdHIDWiegand,  0, "<OEM> <facility code> <card number> -- convert facility code/card number to Wiegand code"},
 371         {"brute",   CmdHIDBrute, 0, "<format length> <facility code> -- brute force card number"},
 372         {NULL, NULL, 0, NULL}
 373 };
 374
 375 int CmdLFHID(const char *Cmd) {
 376         clearCommandBuffer();
 377         CmdsParse(CommandTable, Cmd);
 378         return 0;
 379 }
 380
 381 int CmdHelp(const char *Cmd) {
 382         CmdsHelp(CommandTable);
 383         return 0;
 384 }