1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // High frequency Legic commands
9 //-----------------------------------------------------------------------------
10 #include "cmdhflegic.h"
12 static int CmdHelp(const char *Cmd
);
14 #define MAX_LENGTH 1024
16 int usage_legic_calccrc8(void){
17 PrintAndLog("Calculates the legic crc8/crc16 on the input hexbytes.");
18 PrintAndLog("There must be an even number of hexsymbols as input.");
19 PrintAndLog("Usage: hf legic crc8 [h] b <hexbytes> u <uidcrc> c <crc type>");
20 PrintAndLog("Options:");
21 PrintAndLog(" h : this help");
22 PrintAndLog(" b <hexbytes> : hex bytes");
23 PrintAndLog(" u <uidcrc> : MCC hexbyte");
24 PrintAndLog(" c <crc type> : 8|16 bit crc size");
26 PrintAndLog("Samples:");
27 PrintAndLog(" hf legic crc8 b deadbeef1122");
28 PrintAndLog(" hf legic crc8 b deadbeef1122 u 9A c 16");
31 int usage_legic_load(void){
32 PrintAndLog("It loads datasamples from the file `filename` to device memory");
33 PrintAndLog("Usage: hf legic load [h] <file name>");
34 PrintAndLog("Options:");
35 PrintAndLog(" h : this help");
36 PrintAndLog(" <filename> : Name of file to load");
38 PrintAndLog("Samples:");
39 PrintAndLog(" hf legic load filename");
42 int usage_legic_read(void){
43 PrintAndLog("Read data from a legic tag.");
44 PrintAndLog("Usage: hf legic read [h] <offset> <length> <IV>");
45 PrintAndLog("Options:");
46 PrintAndLog(" h : this help");
47 PrintAndLog(" <offset> : offset in data array to start download from");
48 PrintAndLog(" <length> : number of bytes to download");
49 PrintAndLog(" <IV> : (optional) Initialization vector to use (ODD and 7bits)");
51 PrintAndLog("Samples:");
52 PrintAndLog(" hf legic read");
53 PrintAndLog(" hf legic read 10 4");
56 int usage_legic_sim(void){
57 PrintAndLog("Missing help text.");
60 int usage_legic_write(void){
61 PrintAndLog(" Write sample buffer to a legic tag. (use after load or read)");
62 PrintAndLog("Usage: hf legic write [h] <offset> <length> <IV>");
63 PrintAndLog("Options:");
64 PrintAndLog(" h : this help");
65 PrintAndLog(" <offset> : offset in data array to start writing from");
66 PrintAndLog(" <length> : number of bytes to write");
67 PrintAndLog(" <IV> : (optional) Initialization vector to use (ODD and 7bits)");
69 PrintAndLog("Samples:");
70 PrintAndLog(" hf legic write");
71 PrintAndLog(" hf legic write 10 4");
74 int usage_legic_rawwrite(void){
75 PrintAndLog("Write raw data direct to a specific address on legic tag.");
76 PrintAndLog("Usage: hf legic writeraw [h] <address> <value> <IV>");
77 PrintAndLog("Options:");
78 PrintAndLog(" h : this help");
79 PrintAndLog(" <address> : address to write to");
80 PrintAndLog(" <value> : value to write");
81 PrintAndLog(" <IV> : (optional) Initialization vector to use (ODD and 7bits)");
83 PrintAndLog("Samples:");
84 PrintAndLog(" hf legic writeraw");
85 PrintAndLog(" hf legic writeraw 10 4");
88 int usage_legic_fill(void){
89 PrintAndLog("Missing help text.");
92 int usage_legic_info(void){
93 PrintAndLog("Read info from a legic tag.");
94 PrintAndLog("Usage: hf legic info [h]");
95 PrintAndLog("Options:");
96 PrintAndLog(" h : this help");
98 PrintAndLog("Samples:");
99 PrintAndLog(" hf legic info");
103 * Output BigBuf and deobfuscate LEGIC RF tag data.
104 * This is based on information given in the talk held
105 * by Henryk Ploetz and Karsten Nohl at 26c3
107 int CmdLegicDecode(const char *Cmd
) {
109 int i
= 0, k
= 0, segmentNum
= 0, segment_len
= 0, segment_flag
= 0;
110 int crc
= 0, wrp
= 0, wrc
= 0;
111 uint8_t stamp_len
= 0;
112 uint8_t data
[1024]; // receiver buffer
113 char token_type
[5] = {0,0,0,0,0};
115 int bIsSegmented
= 0;
117 // copy data from device
118 GetEMLFromBigBuf(data
, sizeof(data
), 0);
119 if ( !WaitForResponseTimeout(CMD_ACK
, NULL
, 2000)){
120 PrintAndLog("Command execute timeout");
124 // Output CDF System area (9 bytes) plus remaining header area (12 bytes)
126 uint32_t calc_crc
= CRC8Legic(data
, 4);
128 PrintAndLog("\nCDF: System Area");
129 PrintAndLog("------------------------------------------------------");
130 PrintAndLog("MCD: %02x, MSN: %02x %02x %02x, MCC: %02x %s",
136 (calc_crc
== crc
) ? "OK":"Fail"
141 dcf
= ((int)data
[6] << 8) | (int)data
[5];
143 // New unwritten media?
146 PrintAndLog("DCF: %d (%02x %02x), Token Type=NM (New Media)",
152 } else if(dcf
> 60000) { // Master token?
156 if(data
[6] == 0xec) {
157 strncpy(token_type
, "XAM", sizeof(token_type
));
159 stamp_len
= 0x0c - (data
[5] >> 4);
161 switch (data
[5] & 0x7f) {
163 strncpy(token_type
, "IAM", sizeof(token_type
));
164 fl
= (0x2f - (data
[5] & 0x7f)) + 1;
167 strncpy(token_type
, "SAM", sizeof(token_type
));
168 fl
= (0x6f - (data
[5] & 0x7f)) + 1;
171 strncpy(token_type
, "GAM", sizeof(token_type
));
172 fl
= (0x7f - (data
[5] & 0x7f)) + 1;
176 stamp_len
= 0xfc - data
[6];
179 PrintAndLog("DCF: %d (%02x %02x), Token Type=%s (OLE=%01u), OL=%02u, FL=%02u",
184 (data
[5] & 0x80 )>> 7,
189 } else { // Is IM(-S) type of card...
191 if(data
[7] == 0x9F && data
[8] == 0xFF) {
193 strncpy(token_type
, "IM-S", sizeof(token_type
));
195 strncpy(token_type
, "IM", sizeof(token_type
));
198 PrintAndLog("DCF: %d (%02x %02x), Token Type=%s (OLE=%01u)",
207 // Makes no sence to show this on blank media...
211 PrintAndLog("WRP=%02u, WRC=%01u, RD=%01u, SSC=%02x",
213 (data
[7] & 0x70) >> 4,
214 (data
[7] & 0x80) >> 7,
219 // Header area is only available on IM-S cards, on master tokens this data is the master token data itself
220 if(bIsSegmented
|| dcf
> 60000) {
222 PrintAndLog("Master token data");
223 PrintAndLog("%s", sprint_hex(data
+8, 14));
225 PrintAndLog("Remaining Header Area");
226 PrintAndLog("%s", sprint_hex(data
+9, 13));
231 uint8_t segCrcBytes
[8] = {0,0,0,0,0,0,0,0};
232 uint32_t segCalcCRC
= 0;
238 PrintAndLog("\nADF: User Area");
239 PrintAndLog("------------------------------------------------------");
243 // Data start point on segmented cards
247 for (segmentNum
=1; segmentNum
< 128; segmentNum
++ )
249 segment_len
= ((data
[i
+1] ^ crc
) & 0x0f) * 256 + (data
[i
] ^ crc
);
250 segment_flag
= ((data
[i
+1] ^ crc
) & 0xf0) >> 4;
251 wrp
= (data
[i
+2] ^ crc
);
252 wrc
= ((data
[i
+3] ^ crc
) & 0x70) >> 4;
254 bool hasWRC
= (wrc
> 0);
255 bool hasWRP
= (wrp
> wrc
);
256 int wrp_len
= (wrp
- wrc
);
257 int remain_seg_payload_len
= (segment_len
- wrp
- 5);
259 // validate segment-crc
260 segCrcBytes
[0]=data
[0]; //uid0
261 segCrcBytes
[1]=data
[1]; //uid1
262 segCrcBytes
[2]=data
[2]; //uid2
263 segCrcBytes
[3]=data
[3]; //uid3
264 segCrcBytes
[4]=(data
[i
] ^ crc
); //hdr0
265 segCrcBytes
[5]=(data
[i
+1] ^ crc
); //hdr1
266 segCrcBytes
[6]=(data
[i
+2] ^ crc
); //hdr2
267 segCrcBytes
[7]=(data
[i
+3] ^ crc
); //hdr3
269 segCalcCRC
= CRC8Legic(segCrcBytes
, 8);
270 segCRC
= data
[i
+4] ^ crc
;
272 PrintAndLog("Segment %02u \nraw header | 0x%02X 0x%02X 0x%02X 0x%02X \nSegment len: %u, Flag: 0x%X (valid:%01u, last:%01u), WRP: %02u, WRC: %02u, RD: %01u, CRC: 0x%02X (%s)",
280 (segment_flag
& 0x4) >> 2,
281 (segment_flag
& 0x8) >> 3,
284 ((data
[i
+3]^crc
) & 0x80) >> 7,
286 ( segCRC
== segCalcCRC
) ? "OK" : "fail"
292 PrintAndLog("WRC protected area: (I %d | K %d| WRC %d)", i
, k
, wrc
);
293 PrintAndLog("\nrow | data");
294 PrintAndLog("-----+------------------------------------------------");
296 for ( k
=i
; k
< (i
+ wrc
); ++k
)
299 print_hex_break( data
+i
, wrc
, 16);
305 PrintAndLog("Remaining write protected area: (I %d | K %d | WRC %d | WRP %d WRP_LEN %d)",i
, k
, wrc
, wrp
, wrp_len
);
306 PrintAndLog("\nrow | data");
307 PrintAndLog("-----+------------------------------------------------");
309 for (k
=i
; k
< (i
+wrp_len
); ++k
)
312 print_hex_break( data
+i
, wrp_len
, 16);
316 // does this one work? (Answer: Only if KGH/BGH is used with BCD encoded card number! So maybe this will show just garbage...)
318 PrintAndLog("Card ID: %2X%02X%02X", data
[i
-4]^crc
, data
[i
-3]^crc
, data
[i
-2]^crc
);
321 PrintAndLog("Remaining segment payload: (I %d | K %d | Remain LEN %d)", i
, k
, remain_seg_payload_len
);
322 PrintAndLog("\nrow | data");
323 PrintAndLog("-----+------------------------------------------------");
325 for ( k
=i
; k
< (i
+remain_seg_payload_len
); ++k
)
328 print_hex_break( data
+i
, remain_seg_payload_len
, 16);
330 i
+= remain_seg_payload_len
;
332 PrintAndLog("-----+------------------------------------------------\n");
334 // end with last segment
335 if (segment_flag
& 0x8) return 0;
341 // Data start point on unsegmented cards
344 wrp
= data
[7] & 0x0F;
345 wrc
= (data
[7] & 0x70) >> 4;
347 bool hasWRC
= (wrc
> 0);
348 bool hasWRP
= (wrp
> wrc
);
349 int wrp_len
= (wrp
- wrc
);
350 int remain_seg_payload_len
= (1024 - 22 - wrp
); // Any chance to get physical card size here!?
352 PrintAndLog("Unsegmented card - WRP: %02u, WRC: %02u, RD: %01u",
355 (data
[7] & 0x80) >> 7
359 PrintAndLog("WRC protected area: (I %d | WRC %d)", i
, wrc
);
360 PrintAndLog("\nrow | data");
361 PrintAndLog("-----+------------------------------------------------");
362 print_hex_break( data
+i
, wrc
, 16);
367 PrintAndLog("Remaining write protected area: (I %d | WRC %d | WRP %d | WRP_LEN %d)", i
, wrc
, wrp
, wrp_len
);
368 PrintAndLog("\nrow | data");
369 PrintAndLog("-----+------------------------------------------------");
370 print_hex_break( data
+ i
, wrp_len
, 16);
373 // does this one work? (Answer: Only if KGH/BGH is used with BCD encoded card number! So maybe this will show just garbage...)
375 PrintAndLog("Card ID: %2X%02X%02X", data
[i
-4], data
[i
-3], data
[i
-2]);
378 PrintAndLog("Remaining segment payload: (I %d | Remain LEN %d)", i
, remain_seg_payload_len
);
379 PrintAndLog("\nrow | data");
380 PrintAndLog("-----+------------------------------------------------");
381 print_hex_break( data
+ i
, remain_seg_payload_len
, 16);
382 i
+= remain_seg_payload_len
;
384 PrintAndLog("-----+------------------------------------------------\n");
390 int CmdLegicRFRead(const char *Cmd
) {
393 // offset in data memory
394 // number of bytes to read
395 char cmdp
= param_getchar(Cmd
, 0);
396 if ( cmdp
== 'H' || cmdp
== 'h' ) return usage_legic_read();
398 uint32_t offset
= 0, len
= 0, IV
= 1;
399 sscanf(Cmd
, "%x %x %x", &offset
, &len
, &IV
);
401 // OUT-OF-BOUNDS check
402 if ( len
+ offset
> MAX_LENGTH
) {
403 len
= MAX_LENGTH
- offset
;
404 PrintAndLog("Out-of-bound, shorten len to %d", len
);
407 if ( (IV
& 0x7F) != IV
){
409 PrintAndLog("Truncating IV to 7bits");
412 if ( (IV
& 1) == 0 ){
414 PrintAndLog("LSB of IV must be SET");
417 //PrintAndLog("Using IV: 0x%02x", IV);
419 UsbCommand c
= {CMD_READER_LEGIC_RF
, {offset
, len
, IV
}};
420 clearCommandBuffer();
423 if (WaitForResponseTimeout(CMD_ACK
, &resp
, 2000)) {
424 uint8_t isOK
= resp
.arg
[0] & 0xFF;
425 uint16_t len
= resp
.arg
[1] & 0x3FF;
428 uint8_t *data
= malloc(len
);
430 PrintAndLog("Cannot allocate memory");
433 // copy data from device
434 GetEMLFromBigBuf(data
, len
, 0);
435 if ( !WaitForResponseTimeout(CMD_ACK
, NULL
, 2000)){
436 PrintAndLog("Command execute timeout");
442 PrintAndLog("\nData");
443 PrintAndLog("-----------------------------");
444 print_hex_break( data
, len
, 32);
446 PrintAndLog("failed reading tag");
449 PrintAndLog("command execution time out");
455 int CmdLegicLoad(const char *Cmd
) {
457 // iceman: potential bug, where all filepaths or filename which starts with H or h will print the helptext :)
458 char cmdp
= param_getchar(Cmd
, 0);
459 if ( cmdp
== 'H' || cmdp
== 'h' || cmdp
== 0x00) return usage_legic_load();
461 char filename
[FILE_PATH_SIZE
] = {0x00};
462 int len
= strlen(Cmd
);
464 if (len
> FILE_PATH_SIZE
) {
465 PrintAndLog("Filepath too long (was %s bytes), max allowed is %s ", len
, FILE_PATH_SIZE
);
468 memcpy(filename
, Cmd
, len
);
470 FILE *f
= fopen(filename
, "r");
472 PrintAndLog("couldn't open '%s'", Cmd
);
478 uint8_t data
[USB_CMD_DATA_SIZE
] = {0x00};
481 while ( fgets(line
, sizeof(line
), f
) ) {
482 int res
= sscanf(line
, "%x %x %x %x %x %x %x %x",
483 (unsigned int *)&data
[index
],
484 (unsigned int *)&data
[index
+ 1],
485 (unsigned int *)&data
[index
+ 2],
486 (unsigned int *)&data
[index
+ 3],
487 (unsigned int *)&data
[index
+ 4],
488 (unsigned int *)&data
[index
+ 5],
489 (unsigned int *)&data
[index
+ 6],
490 (unsigned int *)&data
[index
+ 7]);
493 PrintAndLog("Error: could not read samples");
499 if ( index
== USB_CMD_DATA_SIZE
){
500 // PrintAndLog("sent %d | %d | %d", index, offset, totalbytes);
501 UsbCommand c
= { CMD_DOWNLOADED_SIM_SAMPLES_125K
, {offset
, 0, 0}};
502 memcpy(c
.d
.asBytes
, data
, sizeof(data
));
503 clearCommandBuffer();
505 if ( !WaitForResponseTimeout(CMD_ACK
, NULL
, 1500)){
506 PrintAndLog("Command execute timeout");
519 UsbCommand c
= { CMD_DOWNLOADED_SIM_SAMPLES_125K
, {offset
, 0, 0}};
520 memcpy(c
.d
.asBytes
, data
, 8);
521 clearCommandBuffer();
523 if ( !WaitForResponseTimeout(CMD_ACK
, NULL
, 1500)){
524 PrintAndLog("Command execute timeout");
530 PrintAndLog("loaded %u samples", totalbytes
);
534 int CmdLegicSave(const char *Cmd
) {
535 int requested
= 1024;
538 char filename
[FILE_PATH_SIZE
] = {0x00};
539 uint8_t got
[1024] = {0x00};
541 memset(filename
, 0, FILE_PATH_SIZE
);
543 sscanf(Cmd
, " %s %i %i", filename
, &requested
, &offset
);
545 /* If no length given save entire legic read buffer */
546 /* round up to nearest 8 bytes so the saved data can be used with legicload */
550 if (requested
% 8 != 0) {
551 int remainder
= requested
% 8;
552 requested
= requested
+ 8 - remainder
;
555 if (offset
+ requested
> sizeof(got
)) {
556 PrintAndLog("Tried to read past end of buffer, <bytes> + <offset> > 1024");
560 GetFromBigBuf(got
, requested
, offset
);
561 if ( !WaitForResponseTimeout(CMD_ACK
, NULL
, 2000)){
562 PrintAndLog("Command execute timeout");
566 FILE *f
= fopen(filename
, "w");
568 PrintAndLog("couldn't open '%s'", Cmd
+1);
572 for (int j
= 0; j
< requested
; j
+= 8) {
573 fprintf(f
, "%02x %02x %02x %02x %02x %02x %02x %02x\n",
574 got
[j
+0], got
[j
+1], got
[j
+2], got
[j
+3],
575 got
[j
+4], got
[j
+5], got
[j
+6], got
[j
+7]
578 if (delivered
>= requested
) break;
582 PrintAndLog("saved %u samples", delivered
);
586 //TODO: write a help text (iceman)
587 int CmdLegicRfSim(const char *Cmd
) {
588 UsbCommand c
= {CMD_SIMULATE_TAG_LEGIC_RF
, {6,3,0}};
589 sscanf(Cmd
, " %"lli
" %"lli
" %"lli
, &c
.arg
[0], &c
.arg
[1], &c
.arg
[2]);
590 clearCommandBuffer();
595 int CmdLegicRfWrite(const char *Cmd
) {
598 // offset - in tag memory
599 // length - num of bytes to be written
600 // IV - initialisation vector
602 char cmdp
= param_getchar(Cmd
, 0);
603 if ( cmdp
== 'H' || cmdp
== 'h' ) return usage_legic_write();
605 uint32_t offset
= 0, len
= 0, IV
= 0;
607 int res
= sscanf(Cmd
, "%x %x %x", &offset
, &len
, &IV
);
609 PrintAndLog("Please specify the offset and length as two hex strings and, optionally, the IV also as an hex string");
613 // OUT-OF-BOUNDS check
614 if ( len
+ offset
> MAX_LENGTH
) {
615 len
= MAX_LENGTH
- offset
;
616 PrintAndLog("Out-of-bound, shorten len to %d", len
);
618 if ( (IV
& 0x7F) != IV
){
620 PrintAndLog("Truncating IV to 7bits");
622 if ( (IV
& 1) == 0 ){
623 IV
|= 0x01; // IV must be odd
624 PrintAndLog("LSB of IV must be SET");
627 UsbCommand c
= {CMD_WRITER_LEGIC_RF
, {offset
, len
, IV
}};
628 clearCommandBuffer();
631 if (WaitForResponseTimeout(CMD_ACK
, &resp
, 2000)) {
632 uint8_t isOK
= resp
.arg
[0] & 0xFF;
635 PrintAndLog("failed writig tag");
638 PrintAndLog("command execution time out");
645 int CmdLegicRfRawWrite(const char *Cmd
) {
647 char cmdp
= param_getchar(Cmd
, 0);
648 if ( cmdp
== 'H' || cmdp
== 'h' ) return usage_legic_rawwrite();
650 uint32_t address
= 0, data
= 0, IV
= 0;
653 UsbCommand c
= { CMD_RAW_WRITER_LEGIC_RF
, {0,0,0} };
654 int res
= sscanf(Cmd
, "%x %x %x", &address
, &data
, &IV
);
656 return usage_legic_rawwrite();
658 // OUT-OF-BOUNDS check
659 if(address
> MAX_LENGTH
)
660 return usage_legic_rawwrite();
662 if ( (IV
& 0x7F) != IV
){
664 PrintAndLog("Truncating IV to 7bits");
666 if ( (IV
& 1) == 0 ){
667 IV
|= 0x01; // IV must be odd
668 PrintAndLog("LSB of IV must be SET");
670 PrintAndLog("Current IV: 0x%02x", IV
);
676 if (c
.arg
[0] == 0x05 || c
.arg
[0] == 0x06) {
677 PrintAndLog("############# DANGER !! #############");
678 PrintAndLog("# changing the DCF is irreversible #");
679 PrintAndLog("#####################################");
680 PrintAndLog("do youe really want to continue? y(es) n(o)");
681 if (scanf(" %c", &answer
) > 0 && (answer
== 'y' || answer
== 'Y')) {
688 clearCommandBuffer();
693 //TODO: write a help text (iceman)
694 int CmdLegicRfFill(const char *Cmd
) {
695 UsbCommand cmd
= {CMD_WRITER_LEGIC_RF
, {0,0,0} };
696 int res
= sscanf(Cmd
, " 0x%"llx
" 0x%"llx
" 0x%"llx
, &cmd
.arg
[0], &cmd
.arg
[1], &cmd
.arg
[2]);
698 PrintAndLog("Please specify the offset, length and value as two hex strings");
703 UsbCommand c
= {CMD_DOWNLOADED_SIM_SAMPLES_125K
, {0, 0, 0}};
704 memset(c
.d
.asBytes
, cmd
.arg
[2], 48);
706 for(i
= 0; i
< 22; i
++) {
709 clearCommandBuffer();
711 WaitForResponse(CMD_ACK
, NULL
);
713 clearCommandBuffer();
718 void static calc4(uint8_t *cmd
, uint8_t len
){
720 //crc_init_ref(&crc, 4, 0x19 >> 1, 0x5, 0, TRUE, TRUE);
721 crc_init(&crc
, 4, 0x19 >> 1, 0x5, 0);
724 crc_update(&crc
, 1, 1); /* CMD_READ */
725 crc_update(&crc
, cmd
[0], 8);
726 crc_update(&crc
, cmd
[1], 8);
727 printf("crc4 %X\n", reflect(crc_finish(&crc
), 4) ) ;
730 crc_update(&crc
, 1, 1); /* CMD_READ */
731 crc_update(&crc
, cmd
[0], 8);
732 crc_update(&crc
, cmd
[1], 8);
733 printf("crc4 %X\n", crc_finish(&crc
) ) ;
735 printf("---- old ---\n");
736 crc_update2(&crc
, 1, 1); /* CMD_READ */
737 crc_update2(&crc
, cmd
[0], 8);
738 crc_update2(&crc
, cmd
[1], 8);
739 printf("crc4 %X \n", reflect(crc_finish(&crc
), 4) ) ;
743 crc_update2(&crc
, 1, 1); /* CMD_READ */
744 crc_update2(&crc
, cmd
[0], 8);
745 crc_update2(&crc
, cmd
[1], 8);
746 printf("crc4 %X\n", crc_finish(&crc
) ) ;
749 int CmdLegicCalcCrc8(const char *Cmd
){
751 uint8_t *data
= NULL
;
752 uint8_t cmdp
= 0, uidcrc
= 0, type
=0;
757 while(param_getchar(Cmd
, cmdp
) != 0x00) {
758 switch(param_getchar(Cmd
, cmdp
)) {
761 // peek at length of the input string so we can
762 // figure out how many elements to malloc in "data"
764 if (param_getptr(Cmd
, &bg
, &en
, cmdp
+1)) {
770 // check that user entered even number of characters
771 // for hex data string
777 // it's possible for user to accidentally enter "b" parameter
778 // more than once - we have to clean previous malloc
779 if (data
) free(data
);
780 data
= malloc(len
>> 1);
781 if ( data
== NULL
) {
782 PrintAndLog("Can't allocate memory. exiting");
787 if (param_gethex(Cmd
, cmdp
+1, data
, len
)) {
797 uidcrc
= param_get8ex(Cmd
, cmdp
+1, 0, 16);
802 type
= param_get8ex(Cmd
, cmdp
+1, 0, 10);
810 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
818 if (data
) free(data
);
819 return usage_legic_calccrc8();
824 PrintAndLog("Legic crc16: %X", CRC16Legic(data
, len
, uidcrc
));
830 PrintAndLog("Legic crc8: %X", CRC8Legic(data
, len
) );
834 if (data
) free(data
);
838 int HFLegicInfo(const char *Cmd
, bool verbose
) {
840 char cmdp
= param_getchar(Cmd
, 0);
841 if ( cmdp
== 'H' || cmdp
== 'h' ) return usage_legic_info();
843 UsbCommand c
= {CMD_LEGIC_INFO
, {0,0,0}};
844 clearCommandBuffer();
847 if (!WaitForResponseTimeout(CMD_ACK
, &resp
, 500)) {
848 if ( verbose
) PrintAndLog("command execution time out");
852 uint8_t isOK
= resp
.arg
[0] & 0xFF;
854 if ( verbose
) PrintAndLog("legic card select failed");
858 legic_card_select_t card
;
859 memcpy(&card
, (legic_card_select_t
*)resp
.d
.asBytes
, sizeof(legic_card_select_t
));
861 PrintAndLog(" UID : %s", sprint_hex(card
.uid
, sizeof(card
.uid
)));
862 switch(card
.cardsize
) {
866 PrintAndLog(" TYPE : MIM%d card (%d bytes)", card
.cardsize
, card
.cardsize
); break;
868 PrintAndLog("Unknown card format: %d", card
.cardsize
);
874 int CmdLegicInfo(const char *Cmd
){
875 return HFLegicInfo(Cmd
, TRUE
);
878 static command_t CommandTable
[] = {
879 {"help", CmdHelp
, 1, "This help"},
880 {"decode", CmdLegicDecode
, 0, "Display deobfuscated and decoded LEGIC RF tag data (use after hf legic reader)"},
881 {"read", CmdLegicRFRead
, 0, "[offset][length] <iv> -- read bytes from a LEGIC card"},
882 {"save", CmdLegicSave
, 0, "<filename> [<length>] -- Store samples"},
883 {"load", CmdLegicLoad
, 0, "<filename> -- Restore samples"},
884 {"sim", CmdLegicRfSim
, 0, "[phase drift [frame drift [req/resp drift]]] Start tag simulator (use after load or read)"},
885 {"write", CmdLegicRfWrite
,0, "<offset> <length> <iv> -- Write sample buffer (user after load or read)"},
886 {"writeraw",CmdLegicRfRawWrite
, 0, "<address> <value> <iv> -- Write direct to address"},
887 {"fill", CmdLegicRfFill
, 0, "<offset> <length> <value> -- Fill/Write tag with constant value"},
888 {"crc8", CmdLegicCalcCrc8
, 1, "Calculate Legic CRC8 over given hexbytes"},
889 {"info", CmdLegicInfo
, 1, "Information"},
890 {NULL
, NULL
, 0, NULL
}
893 int CmdHFLegic(const char *Cmd
) {
894 clearCommandBuffer();
895 CmdsParse(CommandTable
, Cmd
);
899 int CmdHelp(const char *Cmd
) {
900 CmdsHelp(CommandTable
);