git.zerfleddert.de Git - proxmark3-svn/blob

1 //-----------------------------------------------------------------------------

3 //

4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,

5 // at your option, any later version. See the LICENSE.txt file for the text of

6 // the license.

7 //-----------------------------------------------------------------------------

8 // High frequency Legic commands

9 //-----------------------------------------------------------------------------

11 #include "cmdhflegic.h"

13 #include <stdio.h>

14 #include <string.h>

15 #include <inttypes.h>

16 #include "comms.h"

17 #include "ui.h"

18 #include "cmdparser.h"

19 #include "cmdmain.h"

20 #include "util.h"

21 #include "../include/legic.h"

 static int CmdHelp(const char *Cmd);

25 static command_t CommandTable[] =

26 {

         {"help",        CmdHelp,        1, "This help"},

         {"decode",      CmdLegicDecode, 0, "Display deobfuscated and decoded LEGIC RF tag data (use after hf legic reader)"},

         {"reader",      CmdLegicRFRead, 0, "[offset [length]] -- read bytes from a LEGIC card"},

         {"save",        CmdLegicSave,   0, "<filename> [<length>] -- Store samples"},

         {"load",        CmdLegicLoad,   0, "<filename> -- Restore samples"},

         {"sim",         CmdLegicRfSim,  0, "[tagtype, 0:MIM22, 1:MIM256, 2:MIM1024] Start tag simulator (use after load or read)"},

         {"write",       CmdLegicRfWrite,0, "<offset> <length> -- Write sample buffer (user after load or read)"},

         {"fill",        CmdLegicRfFill, 0, "<offset> <length> <value> -- Fill/Write tag with constant value"},

         {NULL,          NULL,           0, NULL}

36 };

 int CmdHFLegic(const char *Cmd)

39 {

40 CmdsParse(CommandTable, Cmd);

41 return 0;

42 }

 int CmdHelp(const char *Cmd)

45 {

46 CmdsHelp(CommandTable);

47 return 0;

48 }

50 /*

51 * Output BigBuf and deobfuscate LEGIC RF tag data.

52 * This is based on information given in the talk held

53 * by Henryk Ploetz and Karsten Nohl at 26c3

54 */

 int CmdLegicDecode(const char *Cmd)

56 {

         int i, j, k, n;

58 int segment_len = 0;

59 int segment_flag = 0;

60 int stamp_len = 0;

61 int crc = 0;

62 int wrp = 0;

63 int wrc = 0;

         uint8_t data_buf[1053]; // receiver buffer

         char out_string[3076]; // just use big buffer - bad practice

66 char token_type[4];

68 // copy data from proxmark into buffer

         GetFromBigBuf(data_buf, sizeof(data_buf), 0, NULL, -1, false);

71 // Output CDF System area (9 bytes) plus remaining header area (12 bytes)

         PrintAndLog("\nCDF: System Area");

75 PrintAndLog("MCD: %02x, MSN: %02x %02x %02x, MCC: %02x",

76 data_buf[0],

77 data_buf[1],

78 data_buf[2],

79 data_buf[3],

80 data_buf[4]

81 );

83 crc = data_buf[4];

         switch (data_buf[5]&0x7f) {

         case 0x00 ... 0x2f:

                 strncpy(token_type, "IAM",sizeof(token_type));

88 break;

         case 0x30 ... 0x6f:

                 strcpy(token_type, "SAM");

91 break;

         case 0x70 ... 0x7f:

                 strcpy(token_type, "GAM");

94 break;

95 default:

                 strcpy(token_type, "???");

97 break;

98 }

         stamp_len = 0xfc - data_buf[6];

101

102 PrintAndLog("DCF: %02x %02x, Token_Type=%s (OLE=%01u), Stamp_len=%02u",

103 data_buf[5],

104 data_buf[6],

105 token_type,

                 (data_buf[5]&0x80)>>7,

107 stamp_len

108 );

109

110 PrintAndLog("WRP=%02u, WRC=%01u, RD=%01u, raw=%02x, SSC=%02x",

                 data_buf[7]&0x0f,

                 (data_buf[7]&0x70)>>4,

                 (data_buf[7]&0x80)>>7,

114 data_buf[7],

115 data_buf[8]

116 );

117

118 PrintAndLog("Remaining Header Area");

119

120 PrintAndLog("%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x",

121 data_buf[9],

122 data_buf[10],

123 data_buf[11],

124 data_buf[12],

125 data_buf[13],

126 data_buf[14],

127 data_buf[15],

128 data_buf[16],

129 data_buf[17],

130 data_buf[18],

131 data_buf[19],

132 data_buf[20],

133 data_buf[21]

134 );

135

         PrintAndLog("\nADF: User Area");

137

138 i = 22;

         for (n=0; n<64; n++) {

                 segment_len = ((data_buf[i+1]^crc)&0x0f) * 256 + (data_buf[i]^crc);

                 segment_flag = ((data_buf[i+1]^crc)&0xf0)>>4;

142

                 wrp = (data_buf[i+2]^crc);

                 wrc = ((data_buf[i+3]^crc)&0x70)>>4;

145

146 PrintAndLog("Segment %02u: raw header=%02x %02x %02x %02x, flag=%01x (valid=%01u, last=%01u), len=%04u, WRP=%02u, WRC=%02u, RD=%01u, CRC=%02x",

147 n,

148 data_buf[i]^crc,

                         data_buf[i+1]^crc,

                         data_buf[i+2]^crc,

                         data_buf[i+3]^crc,

152 segment_flag,

                         (segment_flag&0x4)>>2,

                         (segment_flag&0x8)>>3,

155 segment_len,

156 wrp,

157 wrc,

                         ((data_buf[i+3]^crc)&0x80)>>7,

                         (data_buf[i+4]^crc)

160 );

161

162 i+=5;

163

                 if (wrc>0) {

165 PrintAndLog("WRC protected area:");

                         for (k=0, j=0; k < wrc && j<(sizeof(out_string)-3); k++, i++, j += 3) {

                                 sprintf(&out_string[j], "%02x", (data_buf[i]^crc));

                                 out_string[j+2] = ' ';

169 };

170

171 out_string[j] = '\0';

172

                         PrintAndLog("%s", out_string);

174 }

175

176 if (wrp>wrc) {

177 PrintAndLog("Remaining write protected area:");

178

                         for (k=0, j=0; k < (wrp-wrc) && j<(sizeof(out_string)-3); k++, i++, j += 3) {

                                 sprintf(&out_string[j], "%02x", (data_buf[i]^crc));

                                 out_string[j+2] = ' ';

182 };

183

184 out_string[j] = '\0';

185

                         PrintAndLog("%s", out_string);

                         if((wrp-wrc) == 8) {

                                 sprintf(out_string,"Card ID: %2X%02X%02X",data_buf[i-4]^crc,data_buf[i-3]^crc,data_buf[i-2]^crc);

                                 PrintAndLog("%s", out_string);

190 }

191 }

192

193 PrintAndLog("Remaining segment payload:");

                 for (k=0, j=0; k < (segment_len - wrp - 5) && j<(sizeof(out_string)-3); k++, i++, j += 3) {

                         sprintf(&out_string[j], "%02x", (data_buf[i]^crc));

                         out_string[j+2] = ' ';

197 };

198

199 out_string[j] = '\0';

200

                 PrintAndLog("%s", out_string);

202

203 // end with last segment

                 if (segment_flag & 0x8)

205 return 0;

206 };

207 return 0;

208 }

209

 int CmdLegicRFRead(const char *Cmd)

211 {

         int byte_count=0,offset=0;

         sscanf(Cmd, "%i %i", &offset, &byte_count);

         if(byte_count == 0) byte_count = -1;

         if(byte_count + offset > 1024) byte_count = 1024 - offset;

         UsbCommand c={CMD_READER_LEGIC_RF, {offset, byte_count, 0}};

217 SendCommand(&c);

218 UsbCommand resp;

219 WaitForResponse(CMD_ACK,&resp);

         switch (resp.arg[0]) {

221 legic_card_select_t card;

222 case 0:

                         memcpy(&card, resp.d.asBytes, sizeof(card));

                         PrintAndLog("Card (MIM %i) read, use 'hf legic decode' or", card.cardsize);

                         PrintAndLog("'data hexsamples %d' to view results", (resp.arg[1] + 7) & ~7);

226 break;

227 case 1:

228 PrintAndLog("No or unknown card found, aborting");

229 break;

230 case 2:

                         PrintAndLog("operation failed @ 0x%03.3x", resp.arg[1]);

232 break;

233 }

         return resp.arg[0];

235 }

236

 int CmdLegicLoad(const char *Cmd)

238 {

         char filename[FILE_PATH_SIZE] = {0x00};

240 int len = 0;

241

         if (param_getchar(Cmd, 0) == 'h' || param_getchar(Cmd, 0)== 0x00) {

243 PrintAndLog("It loads datasamples from the file `filename`");

244 PrintAndLog("Usage: hf legic load <file name>");

245 PrintAndLog(" sample: hf legic load filename");

246 return 0;

247 }

248

249 len = strlen(Cmd);

250 if (len > FILE_PATH_SIZE) {

                 PrintAndLog("Filepath too long (was %s bytes), max allowed is %s ", len, FILE_PATH_SIZE);

252 return 0;

253 }

         memcpy(filename, Cmd, len);

255

         FILE *f = fopen(filename, "r");

257 if (!f) {

                 PrintAndLog("couldn't open '%s'", Cmd);

259 return -1;

260 }

         char line[80]; int offset = 0; unsigned int data[8];

         while (fgets(line, sizeof(line), f)) {

                 int res = sscanf(line, "%x %x %x %x %x %x %x %x",

                         &data[0], &data[1], &data[2], &data[3],

                         &data[4], &data[5], &data[6], &data[7]);

                 if (res != 8) {

267 PrintAndLog("Error: could not read samples");

268 fclose(f);

269 return -1;

270 }

                 UsbCommand c={CMD_DOWNLOADED_SIM_SAMPLES_125K, {offset, 1, 0}};

                 int j; for(j = 0; j < 8; j++) {

                         c.d.asBytes[j] = data[j];

274 }

275 SendCommand(&c);

276 WaitForResponse(CMD_ACK, NULL);

277 offset += 8;

278 }

279 fclose(f);

         PrintAndLog("loaded %u samples", offset);

281 return 0;

282 }

283

 int CmdLegicSave(const char *Cmd)

285 {

286 int requested = 1024;

287 int offset = 0;

288 int delivered = 0;

289 char filename[FILE_PATH_SIZE];

290 uint8_t got[1024];

291

         sscanf(Cmd, " %s %i %i", filename, &requested, &offset);

293

294 /* If no length given save entire legic read buffer */

295 /* round up to nearest 8 bytes so the saved data can be used with legicload */

         if (requested == 0) {

297 requested = 1024;

298 }

         if (requested % 8 != 0) {

                 int remainder = requested % 8;

                 requested = requested + 8 - remainder;

302 }

         if (offset + requested > sizeof(got)) {

304 PrintAndLog("Tried to read past end of buffer, <bytes> + <offset> > 1024");

305 return 0;

306 }

307

         FILE *f = fopen(filename, "w");

309 if (!f) {

                 PrintAndLog("couldn't open '%s'", Cmd+1);

311 return -1;

312 }

313

         GetFromBigBuf(got, requested, offset, NULL, -1, false);

315

         for (int j = 0; j < requested; j += 8) {

                 fprintf(f, "%02x %02x %02x %02x %02x %02x %02x %02x\n",

318 got[j+0],

319 got[j+1],

320 got[j+2],

321 got[j+3],

322 got[j+4],

323 got[j+5],

324 got[j+6],

325 got[j+7]

326 );

327 delivered += 8;

328 if (delivered >= requested)

329 break;

330 }

331

332 fclose(f);

         PrintAndLog("saved %u samples", delivered);

334 return 0;

335 }

336

 int CmdLegicRfSim(const char *Cmd)

338 {

339 UsbCommand c={CMD_SIMULATE_TAG_LEGIC_RF};

    c.arg[0] = 1;

    sscanf(Cmd, " %" SCNi64, &c.arg[0]);

342 SendCommand(&c);

343 return 0;

344 }

345

 int CmdLegicRfWrite(const char *Cmd)

347 {

348 UsbCommand c={CMD_WRITER_LEGIC_RF};

         int res = sscanf(Cmd, " 0x%" SCNx64 " 0x%" SCNx64, &c.arg[0], &c.arg[1]);

         if (res != 2) {

351 PrintAndLog("Please specify the offset and length as two hex strings");

352 return -1;

353 }

354 SendCommand(&c);

355 return 0;

356 }

357

 int CmdLegicRfFill(const char *Cmd)

359 {

360 UsbCommand cmd ={CMD_WRITER_LEGIC_RF};

         int res = sscanf(Cmd, " 0x%" SCNx64 " 0x%" SCNx64 " 0x%" SCNx64, &cmd.arg[0], &cmd.arg[1], &cmd.arg[2]);

         if (res != 3) {

363 PrintAndLog("Please specify the offset, length and value as two hex strings");

364 return -1;

365 }

366

367 int i;

         UsbCommand c={CMD_DOWNLOADED_SIM_SAMPLES_125K, {0, 1, 0}};

         for (i = 0; i < 48; i++) {

                 c.d.asBytes[i] = cmd.arg[2];

371 }

         for (i = 0; i < 22; i++) {

                 c.arg[0] = i*48;

374 SendCommand(&c);

375 WaitForResponse(CMD_ACK,NULL);

376 }

377 SendCommand(&cmd);

378 return 0;

379 }

380