git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfguard.c

   1 //-----------------------------------------------------------------------------
   2 //
   3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   4 // at your option, any later version. See the LICENSE.txt file for the text of
   5 // the license.
   6 //-----------------------------------------------------------------------------
   7 // Low frequency Farpoint / Pyramid tag commands
   8 //-----------------------------------------------------------------------------
   9 #include <string.h>
  10 #include <inttypes.h>
  11 #include "cmdlfguard.h"
  12 static int CmdHelp(const char *Cmd);
  13
  14 int usage_lf_guard_clone(void){
  15         PrintAndLog("clone a Guardall tag to a T55x7 tag.");
  16         PrintAndLog("The facility-code is 8-bit and the card number is 16-bit.  Larger values are truncated. ");
  17         PrintAndLog("Currently work only on 26bit");
  18         PrintAndLog("");
  19         PrintAndLog("Usage: lf guard clone <Facility-Code> <Card-Number>");
  20         PrintAndLog("Options :");
  21         PrintAndLog("  <Facility-Code> :  8-bit value facility code");
  22         PrintAndLog("  <Card Number>   : 16-bit value card number");
  23         PrintAndLog("");
  24         PrintAndLog("Sample  : lf guard clone 123 11223");
  25         return 0;
  26 }
  27
  28 int usage_lf_guard_sim(void) {
  29         PrintAndLog("Enables simulation of Guardall card with specified card number.");
  30         PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
  31         PrintAndLog("The facility-code is 8-bit and the card number is 16-bit.  Larger values are truncated.");
  32         PrintAndLog("Currently work only on 26bit");
  33         PrintAndLog("");
  34         PrintAndLog("Usage:  lf guard sim <Card-Number>");
  35         PrintAndLog("Options :");
  36         PrintAndLog("  <Facility-Code> :  8-bit value facility code");
  37         PrintAndLog("  <Card Number>   : 16-bit value card number");
  38         PrintAndLog("");
  39         PrintAndLog("Sample  : lf guard sim 123 11223");
  40         return 0;
  41 }
  42
  43
  44 // Works for 26bits.
  45 int GetGuardBits(uint32_t fc, uint32_t cn, uint8_t *guardBits) {
  46
  47         // Intializes random number generator
  48         time_t t;
  49         srand((unsigned) time(&t));
  50         //uint8_t xorKey = rand() % 0xFF;
  51         uint8_t xorKey = 0x6b;
  52         uint8_t i;
  53
  54
  55         uint8_t pre[96];
  56         memset(pre, 0x00, sizeof(pre));
  57
  58         // Get 26 wiegand from FacilityCode, CardNumber
  59         uint8_t wiegand[24];
  60         memset(wiegand, 0x00, sizeof(wiegand));
  61         num_to_bytebits(fc, 8, wiegand);
  62         num_to_bytebits(cn, 16, wiegand+8);
  63
  64         // add wiegand parity bits (dest, source, len)
  65         wiegand_add_parity(pre, wiegand, 24);
  66
  67         // lets start. 12bytes of data to be produced.
  68         uint8_t rawbytes[12];
  69         memset(rawbytes, 0x00, sizeof(rawbytes));
  70
  71         // xor key
  72         rawbytes[0] = xorKey;
  73
  74         // add format length (decimal)
  75         // len | hex | bin
  76         //  26 | 1A  | 0001 1010
  77         rawbytes[1] = (26 << 2);
  78         //  36 | 24  | 0010 0100
  79         //rawbytes[1] = (36 << 2);
  80         //  40 | 28  | 0010 1000
  81         //rawbytes[1] = (40 << 2);
  82
  83         // 2bit checksum, unknown today,
  84         // these two bits are the last ones of rawbyte[1], hence the LSHIFT above.
  85         rawbytes[2] = 1;
  86         rawbytes[3] = 0;
  87
  88         // add wiegand to rawbytes
  89         for (i = 0; i < 4; ++i)
  90                 rawbytes[i+4] = bytebits_to_byte( pre + (i*8), 8);
  91
  92         if (g_debugMode) printf(" WIE | %s\n", sprint_hex(rawbytes, sizeof(rawbytes)));
  93
  94         // NIBBLE_SWAP (works on all data)
  95         // for (i = 0; i < 12; ++i)
  96                 // rawbytes[i] = SWAP_NIBBLE( rawbytes[i] );
  97
  98         // printf("SWAP | %s\n", sprint_hex(rawbytes, sizeof(rawbytes)));
  99
 100         // XOR (only works on wiegand stuff)
 101         for (i = 1; i < 12; ++i)
 102                 rawbytes[i] ^= xorKey ;
 103
 104         if (g_debugMode) printf(" XOR | %s \n", sprint_hex(rawbytes, sizeof(rawbytes)));
 105
 106         // convert rawbytes to bits in pre
 107         for (i = 0; i < 12; ++i)
 108                 num_to_bytebitsLSBF( rawbytes[i], 8, pre + (i*8));
 109
 110         if (g_debugMode) printf("\n Raw | %s \n", sprint_hex(rawbytes, sizeof(rawbytes)));
 111         if (g_debugMode) printf(" Raw | %s\n", sprint_bin(pre, 64) );
 112
 113         // add spacer bit 0 every 4 bits, starting with index 0,
 114         // 12 bytes, 24 nibbles.  24+1 extra bites. 3bytes.  Ie 9bytes | 1byte xorkey, 8bytes rawdata (64bits, should be enough for a 40bit wiegand)
 115         addParity(pre, guardBits+6, 64, 5, 3);
 116
 117         // preamble
 118         guardBits[0] = 1;
 119         guardBits[1] = 1;
 120         guardBits[2] = 1;
 121         guardBits[3] = 1;
 122         guardBits[4] = 1;
 123         guardBits[5] = 0;
 124 /*               6      B
 125 PRE |          0110   1101   0101   1110   0001   1101   1101   0111   1101011011010110110101101101011
 126 FIN | 111110 0 0110 0 1101 0 0101 0 1110 0 0001 0 1101 0 1101 0 0111 0 110100110011010011001101001100110100110000000000
 127 */
 128
 129         if (g_debugMode) printf(" FIN | %s\n", sprint_bin(guardBits, 96) );
 130         return 1;
 131 }
 132
 133 int CmdGuardRead(const char *Cmd) {
 134         CmdLFRead("s");
 135         getSamples("30000",false);
 136         return CmdG_Prox_II_Demod("");
 137 }
 138
 139 int CmdGuardClone(const char *Cmd) {
 140
 141         char cmdp = param_getchar(Cmd, 0);
 142         if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_guard_clone();
 143
 144         uint32_t facilitycode=0, cardnumber=0, fc = 0, cn = 0;
 145         uint8_t i;
 146         uint8_t bs[96];
 147         memset(bs, 0x00, sizeof(bs));
 148
 149         //GuardProxII - compat mode, ASK/Biphase,  data rate 64, 3 data blocks
 150         uint32_t blocks[5] = {T55x7_MODULATION_BIPHASE | T55x7_BITRATE_RF_64 | 3<<T55x7_MAXBLOCK_SHIFT, 0, 0, 0, 0};
 151
 152 //      if (param_getchar(Cmd, 3) == 'Q' || param_getchar(Cmd, 3) == 'q')
 153 //              blocks[0] = T5555_MODULATION_FSK2 | 50<<T5555_BITRATE_SHIFT | 4<<T5555_MAXBLOCK_SHIFT;
 154
 155         if (sscanf(Cmd, "%u %u", &fc, &cn ) != 2) return usage_lf_guard_clone();
 156
 157         facilitycode = (fc & 0x000000FF);
 158         cardnumber = (cn & 0x0000FFFF);
 159
 160         if ( !GetGuardBits(facilitycode, cardnumber, bs)) {
 161                 PrintAndLog("Error with tag bitstream generation.");
 162                 return 1;
 163         }
 164
 165         blocks[1] = bytebits_to_byte(bs,32);
 166         blocks[2] = bytebits_to_byte(bs+32,32);
 167         blocks[3] = bytebits_to_byte(bs+64,32);
 168
 169         PrintAndLog("Preparing to clone Guardall to T55x7 with Facility Code: %u, Card Number: %u", facilitycode, cardnumber);
 170         PrintAndLog("Blk | Data ");
 171         PrintAndLog("----+------------");
 172         for ( i = 0; i<4; ++i )
 173                 PrintAndLog(" %02d | %08x", i, blocks[i]);
 174
 175         UsbCommand resp;
 176         UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}};
 177
 178         for ( i = 0; i<4; ++i ) {
 179                 c.arg[0] = blocks[i];
 180                 c.arg[1] = i;
 181                 clearCommandBuffer();
 182                 SendCommand(&c);
 183                 if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){
 184                         PrintAndLog("Error occurred, device did not respond during write operation.");
 185                         return -1;
 186                 }
 187         }
 188     return 0;
 189 }
 190
 191 int CmdGuardSim(const char *Cmd) {
 192
 193         char cmdp = param_getchar(Cmd, 0);
 194         if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_guard_sim();
 195
 196         uint32_t facilitycode = 0, cardnumber = 0, fc = 0, cn = 0;
 197
 198         uint8_t bs[96];
 199         size_t size = sizeof(bs);
 200         memset(bs, 0x00, size);
 201
 202         // Pyramid uses:  ASK Biphase, clk: 32, invert: 0
 203         uint64_t arg1, arg2;
 204         arg1 = (10 << 8) + 8;
 205         arg2 = 32 | 0;
 206
 207         if (sscanf(Cmd, "%u %u", &fc, &cn ) != 2) return usage_lf_guard_sim();
 208
 209         facilitycode = (fc & 0x000000FF);
 210         cardnumber = (cn & 0x0000FFFF);
 211
 212         if ( !GetGuardBits(facilitycode, cardnumber, bs)) {
 213                 PrintAndLog("Error with tag bitstream generation.");
 214                 return 1;
 215         }
 216
 217         PrintAndLog("Simulating Guardall - Facility Code: %u, CardNumber: %u", facilitycode, cardnumber );
 218
 219         UsbCommand c = {CMD_ASK_SIM_TAG, {arg1, arg2, size}};
 220         memcpy(c.d.asBytes, bs, size);
 221         clearCommandBuffer();
 222         SendCommand(&c);
 223         return 0;
 224 }
 225
 226 static command_t CommandTable[] = {
 227     {"help",    CmdHelp,                1, "This help"},
 228         {"read",        CmdGuardRead,  0, "Attempt to read and extract tag data"},
 229         {"clone",       CmdGuardClone, 0, "<Facility-Code> <Card Number>  clone Guardall tag"},
 230 //      {"sim",         CmdGuardSim,   0, "<Facility-Code> <Card Number>  simulate Guardall tag"},
 231     {NULL, NULL, 0, NULL}
 232 };
 233
 234 int CmdLFGuard(const char *Cmd) {
 235         clearCommandBuffer();
 236     CmdsParse(CommandTable, Cmd);
 237     return 0;
 238 }
 239
 240 int CmdHelp(const char *Cmd) {
 241     CmdsHelp(CommandTable);
 242     return 0;
 243 }