git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfguard.c

   1 //-----------------------------------------------------------------------------
   2 //
   3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   4 // at your option, any later version. See the LICENSE.txt file for the text of
   5 // the license.
   6 //-----------------------------------------------------------------------------
   7 // Low frequency Farpoint / Pyramid tag commands
   8 //-----------------------------------------------------------------------------
   9 #include <string.h>
  10 #include <inttypes.h>
  11 #include "cmdlfguard.h"
  12 static int CmdHelp(const char *Cmd);
  13
  14 int usage_lf_guard_clone(void){
  15         PrintAndLog("clone a Guardall tag to a T55x7 tag.");
  16         PrintAndLog("The facility-code is 8-bit and the card number is 16-bit.  Larger values are truncated. ");
  17         PrintAndLog("Currently work only on 26bit");
  18         PrintAndLog("");
  19         PrintAndLog("Usage: lf guard clone <Facility-Code> <Card-Number>");
  20         PrintAndLog("Options :");
  21         PrintAndLog("  <Facility-Code> :  8-bit value facility code");
  22         PrintAndLog("  <Card Number>   : 16-bit value card number");
  23         PrintAndLog("");
  24         PrintAndLog("Sample  : lf guard clone 123 11223");
  25         return 0;
  26 }
  27
  28 int usage_lf_guard_sim(void) {
  29         PrintAndLog("Enables simulation of Guardall card with specified card number.");
  30         PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
  31         PrintAndLog("The facility-code is 8-bit and the card number is 16-bit.  Larger values are truncated.");
  32         PrintAndLog("Currently work only on 26bit");
  33         PrintAndLog("");
  34         PrintAndLog("Usage:  lf guard sim <Card-Number>");
  35         PrintAndLog("Options :");
  36         PrintAndLog("  <Facility-Code> :  8-bit value facility code");
  37         PrintAndLog("  <Card Number>   : 16-bit value card number");
  38         PrintAndLog("");
  39         PrintAndLog("Sample  : lf guard sim 123 11223");
  40         return 0;
  41 }
  42
  43
  44 // Works for 26bits.
  45 int GetGuardBits(uint32_t fc, uint32_t cn, uint8_t *guardBits) {
  46
  47         // Intializes random number generator
  48         time_t t;
  49         srand((unsigned) time(&t));
  50         //uint8_t xorKey = rand() % 0xFF;
  51         uint8_t xorKey = 0x66;
  52         uint8_t i;
  53
  54
  55         uint8_t pre[96];
  56         memset(pre, 0x00, sizeof(pre));
  57
  58         // Get 26 wiegand from FacilityCode, CardNumber
  59         uint8_t wiegand[24];
  60         memset(wiegand, 0x00, sizeof(wiegand));
  61         num_to_bytebits(fc, 8, wiegand);
  62         num_to_bytebits(cn, 16, wiegand+8);
  63
  64         // add wiegand parity bits (dest, source, len)
  65         wiegand_add_parity(pre, wiegand, 24);
  66
  67         // lets start. 12bytes of data to be produced.
  68         uint8_t rawbytes[12];
  69         memset(rawbytes, 0x00, sizeof(rawbytes));
  70
  71         // xor key
  72         rawbytes[0] = xorKey;
  73
  74         // add format length (decimal)
  75         // len | hex | bin
  76         //  26 | 1A  | 0001 1010
  77         rawbytes[1] = (26 << 2);
  78         //  36 | 24  | 0010 0100
  79         //rawbytes[1] = (36 << 2);
  80         //  40 | 28  | 0010 1000
  81         //rawbytes[1] = (40 << 2);
  82
  83         // 2bit checksum, unknown today,
  84         // these two bits are the last ones of rawbyte[1], hence the LSHIFT above.
  85         rawbytes[2] = 1;
  86         rawbytes[3] = 0;
  87
  88         // add wiegand to rawbytes
  89         for (i = 0; i < 4; ++i)
  90                 rawbytes[i+4] = bytebits_to_byte( pre + (i*8), 8);
  91
  92         if (g_debugMode) printf(" WIE | %s\n", sprint_hex(rawbytes, sizeof(rawbytes)));
  93
  94         // XOR (only works on wiegand stuff)
  95         for (i = 1; i < 12; ++i)
  96                 rawbytes[i] ^= xorKey ;
  97
  98         if (g_debugMode) printf(" XOR | %s \n", sprint_hex(rawbytes, sizeof(rawbytes)));
  99
 100         // convert rawbytes to bits in pre
 101         for (i = 0; i < 12; ++i)
 102                 num_to_bytebitsLSBF( rawbytes[i], 8, pre + (i*8));
 103
 104         if (g_debugMode) printf("\n Raw | %s \n", sprint_hex(rawbytes, sizeof(rawbytes)));
 105         if (g_debugMode) printf(" Raw | %s\n", sprint_bin(pre, 64) );
 106
 107         // add spacer bit 0 every 4 bits, starting with index 0,
 108         // 12 bytes, 24 nibbles.  24+1 extra bites. 3bytes.  ie 9bytes | 1byte xorkey, 8bytes rawdata (64bits, should be enough for a 40bit wiegand)
 109         addParity(pre, guardBits+6, 64, 5, 3);
 110
 111         // preamble
 112         guardBits[0] = 1;
 113         guardBits[1] = 1;
 114         guardBits[2] = 1;
 115         guardBits[3] = 1;
 116         guardBits[4] = 1;
 117         guardBits[5] = 0;
 118
 119         if (g_debugMode) printf(" FIN | %s\n", sprint_bin(guardBits, 96) );
 120         return 1;
 121 }
 122
 123 int CmdGuardRead(const char *Cmd) {
 124         CmdLFRead("s");
 125         getSamples("20000", TRUE);
 126         return CmdG_Prox_II_Demod("");
 127 }
 128
 129 int CmdGuardClone(const char *Cmd) {
 130
 131         char cmdp = param_getchar(Cmd, 0);
 132         if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_guard_clone();
 133
 134         uint32_t facilitycode=0, cardnumber=0, fc = 0, cn = 0;
 135         uint8_t i;
 136         uint8_t bs[96];
 137         memset(bs, 0x00, sizeof(bs));
 138
 139         //GuardProxII - compat mode, ASK/Biphase,  data rate 64, 3 data blocks
 140         uint32_t blocks[5] = {T55x7_MODULATION_BIPHASE | T55x7_BITRATE_RF_64 | 3<<T55x7_MAXBLOCK_SHIFT, 0, 0, 0, 0};
 141
 142 //      if (param_getchar(Cmd, 3) == 'Q' || param_getchar(Cmd, 3) == 'q')
 143         //t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
 144 //              blocks[0] = T5555_MODULATION_FSK2 | 50<<T5555_BITRATE_SHIFT | 4<<T5555_MAXBLOCK_SHIFT;
 145
 146         if (sscanf(Cmd, "%u %u", &fc, &cn ) != 2) return usage_lf_guard_clone();
 147
 148         facilitycode = (fc & 0x000000FF);
 149         cardnumber = (cn & 0x0000FFFF);
 150
 151         if ( !GetGuardBits(facilitycode, cardnumber, bs)) {
 152                 PrintAndLog("Error with tag bitstream generation.");
 153                 return 1;
 154         }
 155
 156         blocks[1] = bytebits_to_byte(bs,32);
 157         blocks[2] = bytebits_to_byte(bs+32,32);
 158         blocks[3] = bytebits_to_byte(bs+64,32);
 159
 160         PrintAndLog("Preparing to clone Guardall to T55x7 with Facility Code: %u, Card Number: %u", facilitycode, cardnumber);
 161         PrintAndLog("Blk | Data ");
 162         PrintAndLog("----+------------");
 163         for ( i = 0; i<4; ++i )
 164                 PrintAndLog(" %02d | %08x", i, blocks[i]);
 165
 166         UsbCommand resp;
 167         UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}};
 168
 169         for ( i = 0; i<4; ++i ) {
 170                 c.arg[0] = blocks[i];
 171                 c.arg[1] = i;
 172                 clearCommandBuffer();
 173                 SendCommand(&c);
 174                 if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){
 175                         PrintAndLog("Error occurred, device did not respond during write operation.");
 176                         return -1;
 177                 }
 178         }
 179     return 0;
 180 }
 181
 182 int CmdGuardSim(const char *Cmd) {
 183
 184         char cmdp = param_getchar(Cmd, 0);
 185         if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_guard_sim();
 186
 187         uint32_t facilitycode = 0, cardnumber = 0, fc = 0, cn = 0;
 188         uint8_t clock = 64, encoding = 2, separator = 0, invert = 0;
 189
 190         uint8_t bs[96];
 191         memset(bs, 0x00, sizeof(bs));
 192
 193         if (sscanf(Cmd, "%u %u", &fc, &cn ) != 2) return usage_lf_guard_sim();
 194
 195         facilitycode = (fc & 0x000000FF);
 196         cardnumber = (cn & 0x0000FFFF);
 197
 198         if ( !GetGuardBits(facilitycode, cardnumber, bs)) {
 199                 PrintAndLog("Error with tag bitstream generation.");
 200                 return 1;
 201         }
 202
 203         PrintAndLog("Simulating Guardall - Facility Code: %u, CardNumber: %u", facilitycode, cardnumber );
 204
 205         // Guard uses:  clk: 64, invert: 0, encoding: 2 (ASK Biphase)
 206         uint64_t arg1, arg2;
 207         arg1 = (clock << 8) | encoding;
 208         arg2 = (invert << 8) | separator;
 209
 210         uint8_t rawbytes[12];
 211         size_t size = sizeof(rawbytes);
 212         for (uint8_t i=0; i < size; ++i){
 213                 rawbytes[i] =  bytebits_to_byte( bs + (i*8), 8);
 214         }
 215
 216         UsbCommand c = {CMD_ASK_SIM_TAG, {arg1, arg2, size}};
 217         memcpy(c.d.asBytes, rawbytes, size );
 218         clearCommandBuffer();
 219         SendCommand(&c);
 220         return 0;
 221 }
 222
 223 static command_t CommandTable[] = {
 224     {"help",    CmdHelp,                1, "This help"},
 225         {"read",        CmdGuardRead,  0, "Attempt to read and extract tag data"},
 226         {"clone",       CmdGuardClone, 0, "<Facility-Code> <Card Number>  clone Guardall tag"},
 227         {"sim",         CmdGuardSim,   0, "<Facility-Code> <Card Number>  simulate Guardall tag"},
 228     {NULL, NULL, 0, NULL}
 229 };
 230
 231 int CmdLFGuard(const char *Cmd) {
 232         clearCommandBuffer();
 233     CmdsParse(CommandTable, Cmd);
 234     return 0;
 235 }
 236
 237 int CmdHelp(const char *Cmd) {
 238     CmdsHelp(CommandTable);
 239     return 0;
 240 }