git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfnedap.c

   1 //-----------------------------------------------------------------------------
   2 //
   3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   4 // at your option, any later version. See the LICENSE.txt file for the text of
   5 // the license.
   6 //-----------------------------------------------------------------------------
   7 // Low frequency NEDAP tag commands
   8 //-----------------------------------------------------------------------------
   9 #include <string.h>
  10 #include <inttypes.h>
  11 #include "cmdlfnedap.h"
  12 static int CmdHelp(const char *Cmd);
  13
  14 int usage_lf_nedap_clone(void){
  15         PrintAndLog("clone a NEDAP tag to a T55x7 tag.");
  16         PrintAndLog("");
  17         PrintAndLog("Usage: lf nedap clone <Card-Number>");
  18         PrintAndLog("Options :");
  19         PrintAndLog("  <Card Number>   : 24-bit value card number");
  20 //      PrintAndLog("  Q5              : optional - clone to Q5 (T5555) instead of T55x7 chip");
  21         PrintAndLog("");
  22         PrintAndLog("Sample  : lf nedap clone 112233");
  23         return 0;
  24 }
  25
  26 int usage_lf_nedap_sim(void) {
  27         PrintAndLog("Enables simulation of NEDAP card with specified card number.");
  28         PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
  29         PrintAndLog("");
  30         PrintAndLog("Usage:  lf nedap sim <Card-Number>");
  31         PrintAndLog("Options :");
  32         PrintAndLog("  <Card Number>   : 24-bit value card number");
  33         PrintAndLog("");
  34         PrintAndLog("Sample  : lf nedap sim 112233");
  35         return 0;
  36 }
  37
  38 int GetNedapBits(uint32_t cn, uint8_t *nedapBits) {
  39
  40         uint8_t pre[128];
  41         memset(pre, 0x00, sizeof(pre));
  42
  43         // preamble  1111 1111 10 = 0XF8
  44         num_to_bytebits(0xF8, 10, pre);
  45
  46         // fixed tagtype code?  0010 1101 = 0x2D
  47         num_to_bytebits(0x2D, 8, pre+10);
  48
  49         // 46 encrypted bits - UNKNOWN ALGO
  50         //    -- 16 bits checksum. Should be 4x4 checksum,  based on UID and 2 constant values.
  51         //    -- 30 bits undocumented?
  52         num_to_bytebits(cn, 46, pre+18);
  53
  54         //----from this part, the UID in clear text, with a 1bit ZERO as separator between bytes.
  55         pre[64] = 0;
  56
  57         // cardnumber
  58         num_to_bytebits(cn, 24, pre+64);
  59
  60         pre[73] = 0;
  61         pre[82] = 0;
  62         pre[91] = 0;
  63         pre[100] = 0;
  64         pre[109] = 0;
  65         pre[118] = 0;
  66
  67         // add paritybits       (bitsource, dest, sourcelen, paritylen, parityType (odd, even,)
  68         addParity(pre+64, pre+64, 128, 8, 1);
  69 //1111111110001011010000010110100011001001000010110101001101011001000110011010010000000000100001110001001000000001000101011100111
  70         return 1;
  71 }
  72
  73 //NEDAP demod - ASK/Biphase,  RF/64 with preamble of 1111111110  (always a 128 bit data stream)
  74 //print NEDAP Prox ID, encoding, encrypted ID,
  75 int CmdFSKdemodNedap(const char *Cmd) {
  76         //raw ask demod no start bit finding just get binary from wave
  77         uint8_t BitStream[MAX_GRAPH_TRACE_LEN]={0};
  78         size_t size = getFromGraphBuf(BitStream);
  79         if (size==0) return 0;
  80
  81         //get binary from ask wave
  82         if (!ASKbiphaseDemod("0 64 1 0", FALSE)) {
  83                 if (g_debugMode) PrintAndLog("Error NEDAP: ASKbiphaseDemod failed");
  84                 return 0;
  85         }
  86
  87         size = DemodBufferLen;
  88
  89         int idx = NedapDemod(BitStream, &size);
  90         if (idx < 0){
  91                 if (g_debugMode){
  92                         if (idx == -5)
  93                                 PrintAndLog("DEBUG: Error - not enough samples");
  94                         else if (idx == -1)
  95                                 PrintAndLog("DEBUG: Error - only noise found");
  96                         else if (idx == -2)
  97                                 PrintAndLog("DEBUG: Error - problem during ASK/Biphase demod");
  98                         else if (idx == -3)
  99                                 PrintAndLog("DEBUG: Error - Size not correct: %d", size);
 100                         else if (idx == -4)
 101                                 PrintAndLog("DEBUG: Error - NEDAP preamble not found");
 102                         else
 103                                 PrintAndLog("DEBUG: Error - idx: %d",idx);
 104                 }
 105                 return 0;
 106         }
 107
 108 /* Index map
 109 0        10        20          30            40          50        64
 110 |        |         |           |             |           |         |
 111  preamble    enc tag type         encrypted uid                    d    33    d    90    p    04    d    71    d    40    d    45    d    E7    P
 112 1111111110 00101101000001011 0100011001001000010110101001101011001 0 00110011 0 10010000 0 00000100 0 01110001 0 01000000 0 01000101 0 11100111 1
 113                                                                        uid2       uid1       uid0         I          I          R           R
 114          Tag ID is 049033
 115          I = Identical on all tags
 116          R = Random ?
 117          UID2, UID1, UID0 == card number
 118 */
 119
 120         //get raw ID before removing parities
 121         uint32_t rawLo = bytebits_to_byte(BitStream+idx+96,32);
 122         uint32_t rawHi = bytebits_to_byte(BitStream+idx+64,32);
 123         uint32_t rawHi2 = bytebits_to_byte(BitStream+idx+32,32);
 124         uint32_t rawHi3 = bytebits_to_byte(BitStream+idx,32);
 125         setDemodBuf(BitStream,128,idx);
 126
 127         // ok valid card found!
 128         uint32_t cardnum = bytebits_to_byte(BitStream+81, 16);
 129         PrintAndLog("NEDAP ID Found - Card: %d - Raw: %08x%08x%08x%08x", cardnum, rawHi3, rawHi2, rawHi, rawLo);
 130
 131         if (g_debugMode){
 132                 PrintAndLog("DEBUG: idx: %d, Len: %d, Printing Demod Buffer:", idx, 128);
 133                 printDemodBuff();
 134         }
 135         return 1;
 136 }
 137
 138
 139 int CmdLFNedapRead(const char *Cmd) {
 140         CmdLFRead("s");
 141         getSamples("30000",false);
 142         return CmdFSKdemodNedap("");
 143 }
 144 /*
 145 int CmdLFNedapClone(const char *Cmd) {
 146
 147         char cmdp = param_getchar(Cmd, 0);
 148         if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_nedap_clone();
 149
 150         uint32_t cardnumber=0, cn = 0;
 151         uint32_t blocks[5];
 152         uint8_t i;
 153         uint8_t bs[128];
 154         memset(bs, 0x00, sizeof(bs));
 155
 156         if (sscanf(Cmd, "%u", &cn ) != 1) return usage_lf_nedap_clone();
 157
 158         cardnumber = (cn & 0x00FFFFFF);
 159
 160         if ( !GetNedapBits(cardnumber, bs)) {
 161                 PrintAndLog("Error with tag bitstream generation.");
 162                 return 1;
 163         }
 164
 165         ((ASK/biphase   data rawdemod ab 0 64 1 0
 166         //NEDAP - compat mode, ASK/Biphase, data rate 64, 4 data blocks
 167         blocks[0] = T55x7_MODULATION_BIPHASE | T55x7_BITRATE_RF_64 | 4<<T55x7_MAXBLOCK_SHIFT;
 168
 169         if (param_getchar(Cmd, 3) == 'Q' || param_getchar(Cmd, 3) == 'q')
 170                 blocks[0] = T5555_MODULATION_BIPHASE | T5555_INVERT_OUTPUT | 64<<T5555_BITRATE_SHIFT | 4<<T5555_MAXBLOCK_SHIFT;
 171
 172         blocks[1] = bytebits_to_byte(bs,32);
 173         blocks[2] = bytebits_to_byte(bs+32,32);
 174         blocks[3] = bytebits_to_byte(bs+64,32);
 175         blocks[4] = bytebits_to_byte(bs+96,32);
 176
 177         PrintAndLog("Preparing to clone NEDAP to T55x7 with card number: %u", cardnumber);
 178         PrintAndLog("Blk | Data ");
 179         PrintAndLog("----+------------");
 180         for ( i = 0; i<5; ++i )
 181                 PrintAndLog(" %02d | %08" PRIx32, i, blocks[i]);
 182
 183         UsbCommand resp;
 184         UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}};
 185
 186         for ( i = 0; i<5; ++i ) {
 187                 c.arg[0] = blocks[i];
 188                 c.arg[1] = i;
 189                 clearCommandBuffer();
 190                 SendCommand(&c);
 191                 if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){
 192                         PrintAndLog("Error occurred, device did not respond during write operation.");
 193                         return -1;
 194                 }
 195         }
 196     return 0;
 197 }
 198 */
 199
 200 int CmdLFNedapSim(const char *Cmd) {
 201
 202         char cmdp = param_getchar(Cmd, 0);
 203         if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_nedap_sim();
 204
 205         uint32_t cardnumber = 0, cn = 0;
 206
 207         uint8_t bs[128];
 208         size_t size = sizeof(bs);
 209         memset(bs, 0x00, size);
 210
 211         // NEDAP,  Bihase = 2, clock 64, inverted,
 212         uint8_t encoding = 2, separator = 0, clk=64, invert=1;
 213         uint16_t arg1, arg2;
 214         arg1 = clk << 8 | encoding;
 215         arg2 = invert << 8 | separator;
 216
 217         if (sscanf(Cmd, "%u", &cn ) != 2) return usage_lf_nedap_sim();
 218         cardnumber = (cn & 0x00FFFFFF);
 219
 220         if ( !GetNedapBits(cardnumber, bs)) {
 221                 PrintAndLog("Error with tag bitstream generation.");
 222                 return 1;
 223         }
 224
 225         PrintAndLog("Simulating Nedap - CardNumber: %u", cardnumber );
 226
 227         UsbCommand c = {CMD_ASK_SIM_TAG, {arg1, arg2, size}};
 228         memcpy(c.d.asBytes, bs, size);
 229         clearCommandBuffer();
 230         SendCommand(&c);
 231         return 0;
 232 }
 233
 234 static command_t CommandTable[] = {
 235     {"help",    CmdHelp,                1, "This help"},
 236         {"read",        CmdLFNedapRead,  0, "Attempt to read and extract tag data"},
 237 //      {"clone",       CmdLFNedapClone, 0, "<Card Number>  clone nedap tag"},
 238         {"sim",         CmdLFNedapSim,   0, "<Card Number>  simulate nedap tag"},
 239     {NULL, NULL, 0, NULL}
 240 };
 241
 242 int CmdLFNedap(const char *Cmd) {
 243         clearCommandBuffer();
 244     CmdsParse(CommandTable, Cmd);
 245     return 0;
 246 }
 247
 248 int CmdHelp(const char *Cmd) {
 249     CmdsHelp(CommandTable);
 250     return 0;
 251 }