/* Generate Keystream */
uint32_t get_key_stream(int skip, int count) {
- uint32_t key = 0;
+
int i;
// Use int to enlarge timer tc to 32bit
legic_prng_bc += prng_timer->TC_CV;
// reset the prng timer.
- ResetTimer(prng_timer);
/* If skip == -1, forward prng time based */
if(skip == -1) {
i = (count == 6) ? -1 : legic_read_count;
- /* Write Time Data into LOG */
- // uint8_t *BigBuf = BigBuf_get_addr();
- // BigBuf[OFFSET_LOG+128+i] = legic_prng_count();
- // BigBuf[OFFSET_LOG+256+i*4] = (legic_prng_bc >> 0) & 0xff;
- // BigBuf[OFFSET_LOG+256+i*4+1] = (legic_prng_bc >> 8) & 0xff;
- // BigBuf[OFFSET_LOG+256+i*4+2] = (legic_prng_bc >>16) & 0xff;
- // BigBuf[OFFSET_LOG+256+i*4+3] = (legic_prng_bc >>24) & 0xff;
- // BigBuf[OFFSET_LOG+384+i] = count;
+ // log
+ //uint8_t cmdbytes[] = {bits, BYTEx(data, 0), BYTEx(data, 1), BYTEx(send, 0), BYTEx(send, 1), legic_prng_count()};
+ //LogTrace(cmdbytes, sizeof(cmdbytes), starttime, GET_TICKS, NULL, TRUE);
/* Generate KeyStream */
- for(i=0; i<count; i++) {
- key |= legic_prng_get_bit() << i;
- legic_prng_forward(1);
- }
- return key;
+ return legic_prng_get_bits(count);
}
/* Send a frame in tag mode, the FPGA must have been set up by
* LegicRfSimulate
*/
-void frame_send_tag(uint16_t response, uint8_t bits, uint8_t crypt) {
+void frame_send_tag(uint16_t response, uint8_t bits) {
+
+ uint16_t mask = 1;
+
/* Bitbang the response */
- LOW(GPIO_SSC_DOUT);
+ SHORT_COIL;
AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
- /* Use time to crypt frame */
- if(crypt) {
- legic_prng_forward(2); /* TAG_FRAME_WAIT -> shift by 2 */
- response ^= legic_prng_get_bits(bits);
- }
+ /* TAG_FRAME_WAIT -> shift by 2 */
+ legic_prng_forward(2);
+ response ^= legic_prng_get_bits(bits);
/* Wait for the frame start */
- WaitUS( TAG_FRAME_WAIT );
+ WaitTicks( TAG_FRAME_WAIT );
- uint8_t bit = 0;
- for(int i = 0; i < bits; i++) {
-
- bit = response & 1;
- response >>= 1;
-
- if (bit)
- HIGH(GPIO_SSC_DOUT);
+ for (; mask < BITMASK(bits); mask <<= 1) {
+ if (send & mask)
+ OPEN_COIL;
else
- LOW(GPIO_SSC_DOUT);
-
- WaitUS(100);
+ SHORT_COIL;
+ WaitTicks(TAG_BIT_PERIOD);
}
- LOW(GPIO_SSC_DOUT);
+ SHORT_COIL;
}
/* Send a frame in reader mode, the FPGA must have been set up by
{
uint8_t *BigBuf = BigBuf_get_addr();
- /* First Part of Handshake (IV) */
- if(f->bits == 7) {
+ /* First Part of Handshake (IV) */
+ if(f->bits == 7) {
+
+ LED_C_ON();
- LED_C_ON();
-
// Reset prng timer
ResetTimer(prng_timer);
-
- legic_prng_init(f->data);
- frame_send_tag(0x3d, 6, 1); /* 0x3d^0x26 = 0x1B */
- legic_state = STATE_IV;
- legic_read_count = 0;
- legic_prng_bc = 0;
- legic_prng_iv = f->data;
-
-
+
+ legic_prng_init(f->data);
+ frame_send_tag(0x3d, 6); /* 0x3d^0x26 = 0x1B */
+ legic_state = STATE_IV;
+ legic_read_count = 0;
+ legic_prng_bc = 0;
+ legic_prng_iv = f->data;
+
+
ResetTimer(timer);
WaitUS(280);
- return;
- }
+ return;
+ }
/* 0x19==??? */
if(legic_state == STATE_IV) {
//Dbprintf("Data:%03.3x, key:%03.3x, addr: %03.3x, read_c:%u", f->data, key, addr, read_c);
legic_prng_forward(legic_reqresp_drift);
- frame_send_tag(hash | data, 12, 1);
+ frame_send_tag(hash | data, 12);
ResetTimer(timer);
legic_prng_forward(2);
PrintAndLog("Missing help text.");
return 0;
}
+int usage_legic_reader(void){
+ PrintAndLog("Read UID and type information from a legic tag.");
+ PrintAndLog("Usage: hf legic reader [h]");
+ PrintAndLog("Options:");
+ PrintAndLog(" h : this help");
+ PrintAndLog("");
+ PrintAndLog("Samples:");
+ PrintAndLog(" hf legic reader");
+ return 0;
+}
int usage_legic_info(void){
- PrintAndLog("Read info from a legic tag.");
+ PrintAndLog("Reads information from a legic prime tag.");
+ PrintAndLog("Shows systemarea, user areas etc");
PrintAndLog("Usage: hf legic info [h]");
PrintAndLog("Options:");
PrintAndLog(" h : this help");
PrintAndLog(" hf legic info");
return 0;
}
+int usage_legic_dump(void){
+ PrintAndLog("Reads all pages from LEGIC MIM22, MIM256, MIM1024");
+ PrintAndLog("and saves binary dump into the file `filename.bin` or `cardUID.bin`");
+ PrintAndLog("It autodetects card type.\n");
+ PrintAndLog("Usage: hf legic dump [h] o <filename w/o .bin>");
+ PrintAndLog("Options:");
+ PrintAndLog(" h : this help");
+ PrintAndLog(" n <FN> : filename w/o .bin to save the dump as");
+ PrintAndLog("");
+ PrintAndLog("Samples:");
+ PrintAndLog(" hf legic dump");
+ PrintAndLog(" hf legic dump o myfile");
+ return 0;
+}
+
/*
* Output BigBuf and deobfuscate LEGIC RF tag data.
* This is based on information given in the talk held
* by Henryk Ploetz and Karsten Nohl at 26c3
*/
-int CmdLegicDecode(const char *Cmd) {
+int CmdLegicInfo(const char *Cmd) {
+
+ char cmdp = param_getchar(Cmd, 0);
+ if ( cmdp == 'H' || cmdp == 'h' ) return usage_legic_info();
int i = 0, k = 0, segmentNum = 0, segment_len = 0, segment_flag = 0;
int crc = 0, wrp = 0, wrc = 0;
int dcf = 0;
int bIsSegmented = 0;
+ CmdLegicRFRead("0 21 55");
+
// copy data from device
GetEMLFromBigBuf(data, sizeof(data), 0);
if ( !WaitForResponseTimeout(CMD_ACK, NULL, 2000)){
return 0;
}
-int HFLegicInfo(const char *Cmd, bool verbose) {
+int HFLegicReader(const char *Cmd, bool verbose) {
char cmdp = param_getchar(Cmd, 0);
if ( cmdp == 'H' || cmdp == 'h' ) return usage_legic_info();
}
return 0;
}
-int CmdLegicInfo(const char *Cmd){
- return HFLegicInfo(Cmd, TRUE);
+int CmdLegicReader(const char *Cmd){
+ return HFLegicReader(Cmd, TRUE);
}
+
+int CmdLegicDump(const char *Cmd){
+ char cmdp = param_getchar(Cmd, 0);
+ if ( cmdp == 'H' || cmdp == 'h' ) return usage_legic_dump();
+ return 0;
+}
static command_t CommandTable[] = {
- {"help", CmdHelp, 1, "This help"},
- {"decode", CmdLegicDecode, 0, "Display deobfuscated and decoded LEGIC RF tag data (use after hf legic reader)"},
- {"read", CmdLegicRFRead, 0, "[offset][length] <iv> -- read bytes from a LEGIC card"},
- {"save", CmdLegicSave, 0, "<filename> [<length>] -- Store samples"},
- {"load", CmdLegicLoad, 0, "<filename> -- Restore samples"},
- {"sim", CmdLegicRfSim, 0, "[phase drift [frame drift [req/resp drift]]] Start tag simulator (use after load or read)"},
- {"write", CmdLegicRfWrite,0, "<offset> <length> <iv> -- Write sample buffer (user after load or read)"},
+ {"help", CmdHelp, 1, "This help"},
+ {"reader", CmdLegicReader, 1, "LEGIC Prime Reader UID and Type tag info"},
+ {"info", CmdLegicInfo, 0, "Display deobfuscated and decoded LEGIC Prime tag data"},
+ {"dump", CmdLegicDump, 0, "Dump LEGIC Prime card to binary file"},
+ {"rdmem", CmdLegicRFRead, 0, "[offset][length] <iv> -- read bytes from a LEGIC card"},
+ {"save", CmdLegicSave, 0, "<filename> [<length>] -- Store samples"},
+ {"load", CmdLegicLoad, 0, "<filename> -- Restore samples"},
+ {"sim", CmdLegicRfSim, 0, "[phase drift [frame drift [req/resp drift]]] Start tag simulator (use after load or read)"},
+ {"write", CmdLegicRfWrite, 0, "<offset> <length> <iv> -- Write sample buffer (user after load or read)"},
{"writeraw",CmdLegicRfRawWrite, 0, "<address> <value> <iv> -- Write direct to address"},
- {"fill", CmdLegicRfFill, 0, "<offset> <length> <value> -- Fill/Write tag with constant value"},
- {"crc8", CmdLegicCalcCrc8, 1, "Calculate Legic CRC8 over given hexbytes"},
- {"info", CmdLegicInfo, 1, "Information"},
+ {"fill", CmdLegicRfFill, 0, "<offset> <length> <value> -- Fill/Write tag with constant value"},
+ {"crc8", CmdLegicCalcCrc8, 1, "Calculate Legic CRC8 over given hexbytes"},
{NULL, NULL, 0, NULL}
};
#include "legic.h" // legic_card_select_t struct
int CmdHFLegic(const char *Cmd);
+int CmdLegicInfo(const char *Cmd);
int CmdLegicRFRead(const char *Cmd);
-int CmdLegicDecode(const char *Cmd);
int CmdLegicLoad(const char *Cmd);
int CmdLegicSave(const char *Cmd);
int CmdLegicRfSim(const char *Cmd);
int CmdLegicRfFill(const char *Cmd);
int CmdLegicCalcCrc8(const char *Cmd);
-int CmdLegicInfo(const char *Cmd);
-int HFLegicInfo(const char *Cmd, bool verbose);
+
+int CmdLegicReader(const char *Cmd);
+int HFLegicReader(const char *Cmd, bool verbose);
+
+int CmdLegicDump(const char *Cmd);
+
int usage_legic_calccrc8(void);
int usage_legic_load(void);
int usage_legic_read(void);
+int usage_legic_sim(void);
+int usage_legic_write(void);
+int usage_legic_rawwrite(void);
+int usage_legic_fill(void);
+int usage_legic_reader(void);
int usage_legic_info(void);
+int usage_legic_dump(void);
#endif
projects / proxmark3-svn / commitdiff