]> cvs.zerfleddert.de Git - proxmark3-svn/blame - client/cmdlfhitag.c
code clean up, added some comments to hitag
[proxmark3-svn] / client / cmdlfhitag.c
CommitLineData
db09cb3a 1//-----------------------------------------------------------------------------
2// Copyright (C) 2012 Roel Verdult
3//
4// This code is licensed to you under the terms of the GNU GPL, version 2 or,
5// at your option, any later version. See the LICENSE.txt file for the text of
6// the license.
7//-----------------------------------------------------------------------------
8// Low frequency Hitag support
9//-----------------------------------------------------------------------------
10
11#include <stdio.h>
12#include <stdlib.h>
13#include <string.h>
14#include "data.h"
902cb3c0 15#include "proxmark3.h"
db09cb3a 16#include "ui.h"
17#include "cmdparser.h"
18#include "common.h"
19#include "util.h"
20#include "hitag2.h"
902cb3c0 21#include "sleep.h"
22#include "cmdmain.h"
db09cb3a 23
24static int CmdHelp(const char *Cmd);
25
47e18126 26size_t nbytes(size_t nbits) {
27 return (nbits/8)+((nbits%8)>0);
28}
29
db09cb3a 30int CmdLFHitagList(const char *Cmd)
31{
f71f4deb 32 uint8_t *got = malloc(USB_CMD_DATA_SIZE);
33
34 // Query for the actual size of the trace
35 UsbCommand response;
36 GetFromBigBuf(got, USB_CMD_DATA_SIZE, 0);
37 WaitForResponse(CMD_ACK, &response);
38 uint16_t traceLen = response.arg[2];
39 if (traceLen > USB_CMD_DATA_SIZE) {
40 uint8_t *p = realloc(got, traceLen);
41 if (p == NULL) {
42 PrintAndLog("Cannot allocate memory for trace");
43 free(got);
44 return 2;
45 }
46 got = p;
47 GetFromBigBuf(got, traceLen, 0);
48 WaitForResponse(CMD_ACK,NULL);
49 }
50
51 PrintAndLog("recorded activity (TraceLen = %d bytes):");
52 PrintAndLog(" ETU :nbits: who bytes");
53 PrintAndLog("---------+-----+----+-----------");
db09cb3a 54
f71f4deb 55 int i = 0;
56 int prev = -1;
57 int len = strlen(Cmd);
b915fda3 58
f71f4deb 59 char filename[FILE_PATH_SIZE] = { 0x00 };
60 FILE* pf = NULL;
b915fda3 61
09181a54 62 if (len > FILE_PATH_SIZE) len = FILE_PATH_SIZE;
f71f4deb 63 memcpy(filename, Cmd, len);
b915fda3 64
f71f4deb 65 if (strlen(filename) > 0) {
66 if ((pf = fopen(filename,"wb")) == NULL) {
67 PrintAndLog("Error: Could not open file [%s]",filename);
68 return 1;
69 }
b915fda3 70 }
db09cb3a 71
f71f4deb 72 for (;;) {
b915fda3 73
f71f4deb 74 if(i > traceLen) { break; }
75
76 bool isResponse;
77 int timestamp = *((uint32_t *)(got+i));
78 if (timestamp & 0x80000000) {
79 timestamp &= 0x7fffffff;
80 isResponse = 1;
81 } else {
82 isResponse = 0;
83 }
84
85 int parityBits = *((uint32_t *)(got+i+4));
86 // 4 bytes of additional information...
87 // maximum of 32 additional parity bit information
88 //
89 // TODO:
90 // at each quarter bit period we can send power level (16 levels)
91 // or each half bit period in 256 levels.
92
93 int bits = got[i+8];
94 int len = nbytes(got[i+8]);
95
96 if (len > 100) {
97 break;
98 }
99 if (i + len > traceLen) { break;}
100
101 uint8_t *frame = (got+i+9);
102
103 // Break and stick with current result if buffer was not completely full
104 if (frame[0] == 0x44 && frame[1] == 0x44 && frame[3] == 0x44) { break; }
105
106 char line[1000] = "";
107 int j;
108 for (j = 0; j < len; j++) {
109 int oddparity = 0x01;
110 int k;
111
112 for (k=0;k<8;k++) {
113 oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
114 }
115
116 //if((parityBits >> (len - j - 1)) & 0x01) {
117 if (isResponse && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
118 sprintf(line+(j*4), "%02x! ", frame[j]);
119 }
120 else {
121 sprintf(line+(j*4), "%02x ", frame[j]);
122 }
123 }
124
125 PrintAndLog(" +%7d: %3d: %s %s",
126 (prev < 0 ? 0 : (timestamp - prev)),
127 bits,
128 (isResponse ? "TAG" : " "),
129 line);
130
131 if (pf) {
132 fprintf(pf," +%7d: %3d: %s %s\n",
133 (prev < 0 ? 0 : (timestamp - prev)),
134 bits,
135 (isResponse ? "TAG" : " "),
136 line);
137 }
138
139 prev = timestamp;
140 i += (len + 9);
141 }
2d495a81 142
f71f4deb 143 if (pf) {
144 fclose(pf);
145 PrintAndLog("Recorded activity succesfully written to file: %s", filename);
146 }
97d582a6 147
f71f4deb 148 free(got);
149 return 0;
db09cb3a 150}
151
152int CmdLFHitagSnoop(const char *Cmd) {
09181a54 153 UsbCommand c = {CMD_SNOOP_HITAG};
154 clearCommandBuffer();
155 SendCommand(&c);
156 return 0;
db09cb3a 157}
158
159int CmdLFHitagSim(const char *Cmd) {
b915fda3 160
09181a54 161 UsbCommand c = {CMD_SIMULATE_HITAG};
b915fda3 162 char filename[FILE_PATH_SIZE] = { 0x00 };
db09cb3a 163 FILE* pf;
164 bool tag_mem_supplied;
09181a54 165
b915fda3 166 int len = strlen(Cmd);
167 if (len > FILE_PATH_SIZE) len = FILE_PATH_SIZE;
168 memcpy(filename, Cmd, len);
09181a54 169
db09cb3a 170 if (strlen(filename) > 0) {
171 if ((pf = fopen(filename,"rb+")) == NULL) {
172 PrintAndLog("Error: Could not open file [%s]",filename);
173 return 1;
174 }
175 tag_mem_supplied = true;
759c16b3 176 if (fread(c.d.asBytes,48,1,pf) == 0) {
09181a54 177 PrintAndLog("Error: File reading error");
178 fclose(pf);
759c16b3 179 return 1;
09181a54 180 }
db09cb3a 181 fclose(pf);
182 } else {
183 tag_mem_supplied = false;
184 }
09181a54 185
db09cb3a 186 // Does the tag comes with memory
187 c.arg[0] = (uint32_t)tag_mem_supplied;
188
09181a54 189 clearCommandBuffer();
190 SendCommand(&c);
191 return 0;
db09cb3a 192}
193
194int CmdLFHitagReader(const char *Cmd) {
db09cb3a 195
09181a54 196
db09cb3a 197 UsbCommand c = {CMD_READER_HITAG};//, {param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16),param_get32ex(Cmd,3,0,16)}};
198 hitag_data* htd = (hitag_data*)c.d.asBytes;
199 hitag_function htf = param_get32ex(Cmd,0,0,10);
200
201 switch (htf) {
202 case RHT2F_PASSWORD: {
203 num_to_bytes(param_get32ex(Cmd,1,0,16),4,htd->pwd.password);
204 } break;
205 case RHT2F_AUTHENTICATE: {
206 num_to_bytes(param_get32ex(Cmd,1,0,16),4,htd->auth.NrAr);
207 num_to_bytes(param_get32ex(Cmd,2,0,16),4,htd->auth.NrAr+4);
208 } break;
bde10a50 209 case RHT2F_CRYPTO: {
210 num_to_bytes(param_get64ex(Cmd,1,0,16),6,htd->crypto.key);
bde10a50 211 } break;
db09cb3a 212 case RHT2F_TEST_AUTH_ATTEMPTS: {
213 // No additional parameters needed
214 } break;
215 default: {
216 PrintAndLog("Error: unkown reader function %d",htf);
ab4da50d 217 PrintAndLog("Hitag reader functions");
218 PrintAndLog(" HitagS (0*)");
219 PrintAndLog(" Hitag1 (1*)");
220 PrintAndLog(" Hitag2 (2*)");
221 PrintAndLog(" 21 <password> (password mode)");
222 PrintAndLog(" 22 <nr> <ar> (authentication)");
223 PrintAndLog(" 23 <key> (authentication) key is in format: ISK high + ISK low");
224 PrintAndLog(" 25 (test recorded authentications)");
db09cb3a 225 return 1;
226 } break;
227 }
228
229 // Copy the hitag2 function into the first argument
230 c.arg[0] = htf;
231
09181a54 232 clearCommandBuffer();
233 // Send the command to the proxmark
234 SendCommand(&c);
ab4da50d 235
09181a54 236 UsbCommand resp;
237 WaitForResponse(CMD_ACK,&resp);
238
239 // Check the return status, stored in the first argument
240 if (resp.arg[0] == false) return 1;
241
242 uint32_t id = bytes_to_num(resp.d.asBytes,4);
243 char filename[FILE_PATH_SIZE];
244 FILE* pf = NULL;
245
246 sprintf(filename,"%08x_%04x.ht2",id,(rand() & 0xffff));
247 if ((pf = fopen(filename,"wb")) == NULL) {
248 PrintAndLog("Error: Could not open file [%s]",filename);
249 return 1;
250 }
251
252 // Write the 48 tag memory bytes to file and finalize
253 fwrite(resp.d.asBytes,1,48,pf);
254 fclose(pf);
255
256 PrintAndLog("Succesfully saved tag memory to [%s]",filename);
257 return 0;
db09cb3a 258}
259
09181a54 260static command_t CommandTable[] = {
261 {"help", CmdHelp, 1, "This help"},
262 {"list", CmdLFHitagList, 1, "<outfile> List Hitag trace history"},
263 {"reader", CmdLFHitagReader, 1, "Act like a Hitag Reader"},
264 {"sim", CmdLFHitagSim, 1, "<infile> Simulate Hitag transponder"},
265 {"snoop", CmdLFHitagSnoop, 1, "Eavesdrop Hitag communication"},
266 {NULL, NULL, 0, NULL}
db09cb3a 267};
268
269int CmdLFHitag(const char *Cmd)
270{
09181a54 271 CmdsParse(CommandTable, Cmd);
272 return 0;
db09cb3a 273}
274
275int CmdHelp(const char *Cmd)
276{
09181a54 277 CmdsHelp(CommandTable);
278 return 0;
db09cb3a 279}
Impressum, Datenschutz