]>
Commit | Line | Data |
---|---|---|
db09cb3a | 1 | //----------------------------------------------------------------------------- |
2 | // Copyright (C) 2012 Roel Verdult | |
3 | // | |
4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, | |
5 | // at your option, any later version. See the LICENSE.txt file for the text of | |
6 | // the license. | |
7 | //----------------------------------------------------------------------------- | |
8 | // Low frequency Hitag support | |
9 | //----------------------------------------------------------------------------- | |
10 | ||
11 | #include <stdio.h> | |
12 | #include <stdlib.h> | |
13 | #include <string.h> | |
14 | #include "data.h" | |
902cb3c0 | 15 | #include "proxmark3.h" |
db09cb3a | 16 | #include "ui.h" |
17 | #include "cmdparser.h" | |
f38a1528 | 18 | #include "../include/common.h" |
db09cb3a | 19 | #include "util.h" |
f38a1528 | 20 | #include "../include/hitag2.h" |
902cb3c0 | 21 | #include "sleep.h" |
22 | #include "cmdmain.h" | |
db09cb3a | 23 | |
24 | static int CmdHelp(const char *Cmd); | |
25 | ||
47e18126 | 26 | size_t nbytes(size_t nbits) { |
27 | return (nbits/8)+((nbits%8)>0); | |
28 | } | |
29 | ||
db09cb3a | 30 | int CmdLFHitagList(const char *Cmd) |
31 | { | |
95e63594 | 32 | uint8_t got[TRACE_BUFFER_SIZE]; |
db09cb3a | 33 | GetFromBigBuf(got,sizeof(got),0); |
902cb3c0 | 34 | WaitForResponse(CMD_ACK,NULL); |
35 | ||
db09cb3a | 36 | PrintAndLog("recorded activity:"); |
47e18126 | 37 | PrintAndLog(" ETU :nbits: who bytes"); |
38 | PrintAndLog("---------+-----+----+-----------"); | |
db09cb3a | 39 | |
40 | int i = 0; | |
41 | int prev = -1; | |
42 | ||
ab4da50d | 43 | char filename[256]; |
44 | FILE* pf = NULL; | |
45 | ||
db09cb3a | 46 | for (;;) { |
95e63594 | 47 | |
48 | if(i >= TRACE_BUFFER_SIZE) { break; } | |
db09cb3a | 49 | |
50 | bool isResponse; | |
51 | int timestamp = *((uint32_t *)(got+i)); | |
52 | if (timestamp & 0x80000000) { | |
53 | timestamp &= 0x7fffffff; | |
54 | isResponse = 1; | |
55 | } else { | |
56 | isResponse = 0; | |
57 | } | |
58 | ||
db09cb3a | 59 | int parityBits = *((uint32_t *)(got+i+4)); |
60 | // 4 bytes of additional information... | |
61 | // maximum of 32 additional parity bit information | |
62 | // | |
63 | // TODO: | |
64 | // at each quarter bit period we can send power level (16 levels) | |
65 | // or each half bit period in 256 levels. | |
66 | ||
47e18126 | 67 | int bits = got[i+8]; |
68 | int len = nbytes(got[i+8]); | |
db09cb3a | 69 | |
70 | if (len > 100) { | |
71 | break; | |
72 | } | |
95e63594 | 73 | if (i + len >= TRACE_BUFFER_SIZE) { break;} |
db09cb3a | 74 | |
75 | uint8_t *frame = (got+i+9); | |
76 | ||
77 | // Break and stick with current result if buffer was not completely full | |
78 | if (frame[0] == 0x44 && frame[1] == 0x44 && frame[3] == 0x44) { break; } | |
79 | ||
80 | char line[1000] = ""; | |
81 | int j; | |
82 | for (j = 0; j < len; j++) { | |
83 | int oddparity = 0x01; | |
84 | int k; | |
85 | ||
86 | for (k=0;k<8;k++) { | |
87 | oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01); | |
88 | } | |
89 | ||
90 | //if((parityBits >> (len - j - 1)) & 0x01) { | |
91 | if (isResponse && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) { | |
92 | sprintf(line+(j*4), "%02x! ", frame[j]); | |
93 | } | |
94 | else { | |
95 | sprintf(line+(j*4), "%02x ", frame[j]); | |
96 | } | |
97 | } | |
98 | ||
47e18126 | 99 | PrintAndLog(" +%7d: %3d: %s %s", |
db09cb3a | 100 | (prev < 0 ? 0 : (timestamp - prev)), |
47e18126 | 101 | bits, |
db09cb3a | 102 | (isResponse ? "TAG" : " "), |
103 | line); | |
104 | ||
2d495a81 | 105 | |
902cb3c0 | 106 | if (pf) { |
47e18126 | 107 | fprintf(pf," +%7d: %3d: %s %s\n", |
2d495a81 | 108 | (prev < 0 ? 0 : (timestamp - prev)), |
47e18126 | 109 | bits, |
2d495a81 | 110 | (isResponse ? "TAG" : " "), |
47e18126 | 111 | line); |
2d495a81 | 112 | } |
113 | ||
db09cb3a | 114 | prev = timestamp; |
115 | i += (len + 9); | |
116 | } | |
2d495a81 | 117 | |
902cb3c0 | 118 | if (pf) { |
2d495a81 | 119 | PrintAndLog("Recorded activity succesfully written to file: %s", filename); |
120 | fclose(pf); | |
121 | } | |
122 | ||
123 | return 0; | |
db09cb3a | 124 | } |
125 | ||
126 | int CmdLFHitagSnoop(const char *Cmd) { | |
127 | UsbCommand c = {CMD_SNOOP_HITAG}; | |
128 | SendCommand(&c); | |
129 | return 0; | |
130 | } | |
131 | ||
132 | int CmdLFHitagSim(const char *Cmd) { | |
463ca973 | 133 | |
134 | UsbCommand c = {CMD_SIMULATE_HITAG}; | |
135 | char filename[FILE_PATH_SIZE] = { 0x00 }; | |
db09cb3a | 136 | FILE* pf; |
137 | bool tag_mem_supplied; | |
463ca973 | 138 | int len = 0; |
db09cb3a | 139 | |
463ca973 | 140 | len = strlen(Cmd); |
141 | if (len > FILE_PATH_SIZE) len = FILE_PATH_SIZE; | |
142 | memcpy(filename, Cmd, len); | |
143 | ||
db09cb3a | 144 | if (strlen(filename) > 0) { |
145 | if ((pf = fopen(filename,"rb+")) == NULL) { | |
146 | PrintAndLog("Error: Could not open file [%s]",filename); | |
147 | return 1; | |
148 | } | |
149 | tag_mem_supplied = true; | |
759c16b3 | 150 | if (fread(c.d.asBytes,48,1,pf) == 0) { |
463ca973 | 151 | PrintAndLog("Error: File reading error"); |
759c16b3 | 152 | return 1; |
463ca973 | 153 | } |
db09cb3a | 154 | fclose(pf); |
155 | } else { | |
156 | tag_mem_supplied = false; | |
157 | } | |
158 | ||
159 | // Does the tag comes with memory | |
160 | c.arg[0] = (uint32_t)tag_mem_supplied; | |
161 | ||
162 | SendCommand(&c); | |
163 | return 0; | |
164 | } | |
165 | ||
166 | int CmdLFHitagReader(const char *Cmd) { | |
167 | // UsbCommand c = {CMD_READER_HITAG}; | |
168 | ||
169 | // param_get32ex(Cmd,1,0,16); | |
170 | UsbCommand c = {CMD_READER_HITAG};//, {param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16),param_get32ex(Cmd,3,0,16)}}; | |
171 | hitag_data* htd = (hitag_data*)c.d.asBytes; | |
172 | hitag_function htf = param_get32ex(Cmd,0,0,10); | |
173 | ||
174 | switch (htf) { | |
175 | case RHT2F_PASSWORD: { | |
176 | num_to_bytes(param_get32ex(Cmd,1,0,16),4,htd->pwd.password); | |
177 | } break; | |
178 | case RHT2F_AUTHENTICATE: { | |
179 | num_to_bytes(param_get32ex(Cmd,1,0,16),4,htd->auth.NrAr); | |
180 | num_to_bytes(param_get32ex(Cmd,2,0,16),4,htd->auth.NrAr+4); | |
181 | } break; | |
bde10a50 | 182 | case RHT2F_CRYPTO: { |
183 | num_to_bytes(param_get64ex(Cmd,1,0,16),6,htd->crypto.key); | |
184 | // num_to_bytes(param_get32ex(Cmd,2,0,16),4,htd->auth.NrAr+4); | |
185 | } break; | |
db09cb3a | 186 | case RHT2F_TEST_AUTH_ATTEMPTS: { |
187 | // No additional parameters needed | |
188 | } break; | |
189 | default: { | |
190 | PrintAndLog("Error: unkown reader function %d",htf); | |
ab4da50d | 191 | PrintAndLog("Hitag reader functions"); |
192 | PrintAndLog(" HitagS (0*)"); | |
193 | PrintAndLog(" Hitag1 (1*)"); | |
194 | PrintAndLog(" Hitag2 (2*)"); | |
195 | PrintAndLog(" 21 <password> (password mode)"); | |
196 | PrintAndLog(" 22 <nr> <ar> (authentication)"); | |
197 | PrintAndLog(" 23 <key> (authentication) key is in format: ISK high + ISK low"); | |
198 | PrintAndLog(" 25 (test recorded authentications)"); | |
db09cb3a | 199 | return 1; |
200 | } break; | |
201 | } | |
202 | ||
203 | // Copy the hitag2 function into the first argument | |
204 | c.arg[0] = htf; | |
205 | ||
ab4da50d | 206 | // Send the command to the proxmark |
db09cb3a | 207 | SendCommand(&c); |
ab4da50d | 208 | |
209 | UsbCommand resp; | |
210 | WaitForResponse(CMD_ACK,&resp); | |
211 | ||
212 | // Check the return status, stored in the first argument | |
213 | if (resp.arg[0] == false) return 1; | |
214 | ||
215 | uint32_t id = bytes_to_num(resp.d.asBytes,4); | |
216 | char filename[256]; | |
217 | FILE* pf = NULL; | |
218 | ||
219 | sprintf(filename,"%08x_%04x.ht2",id,(rand() & 0xffff)); | |
220 | if ((pf = fopen(filename,"wb")) == NULL) { | |
221 | PrintAndLog("Error: Could not open file [%s]",filename); | |
222 | return 1; | |
223 | } | |
224 | ||
225 | // Write the 48 tag memory bytes to file and finalize | |
226 | fwrite(resp.d.asBytes,1,48,pf); | |
227 | fclose(pf); | |
228 | ||
229 | PrintAndLog("Succesfully saved tag memory to [%s]",filename); | |
230 | ||
db09cb3a | 231 | return 0; |
232 | } | |
233 | ||
081151ea | 234 | static command_t CommandTable[] = |
db09cb3a | 235 | { |
236 | {"help", CmdHelp, 1, "This help"}, | |
237 | {"list", CmdLFHitagList, 1, "List Hitag trace history"}, | |
238 | {"reader", CmdLFHitagReader, 1, "Act like a Hitag Reader"}, | |
239 | {"sim", CmdLFHitagSim, 1, "Simulate Hitag transponder"}, | |
240 | {"snoop", CmdLFHitagSnoop, 1, "Eavesdrop Hitag communication"}, | |
241 | {NULL, NULL, 0, NULL} | |
242 | }; | |
243 | ||
244 | int CmdLFHitag(const char *Cmd) | |
245 | { | |
081151ea | 246 | CmdsParse(CommandTable, Cmd); |
db09cb3a | 247 | return 0; |
248 | } | |
249 | ||
250 | int CmdHelp(const char *Cmd) | |
251 | { | |
081151ea | 252 | CmdsHelp(CommandTable); |
db09cb3a | 253 | return 0; |
254 | } |