50564be0 |
1 | //----------------------------------------------------------------------------- |
2 | // |
3 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, |
4 | // at your option, any later version. See the LICENSE.txt file for the text of |
5 | // the license. |
6 | //----------------------------------------------------------------------------- |
7 | // Low frequency Farpoint / Pyramid tag commands |
8 | //----------------------------------------------------------------------------- |
42c235e7 |
9 | |
50564be0 |
10 | #include "cmdlfguard.h" |
11 | static int CmdHelp(const char *Cmd); |
12 | |
13 | int usage_lf_guard_clone(void){ |
14 | PrintAndLog("clone a Guardall tag to a T55x7 tag."); |
15 | PrintAndLog("The facility-code is 8-bit and the card number is 16-bit. Larger values are truncated. "); |
16 | PrintAndLog("Currently work only on 26bit"); |
17 | PrintAndLog(""); |
ff9c043d |
18 | PrintAndLog("Usage: lf guard clone <format> <Facility-Code> <Card-Number>"); |
50564be0 |
19 | PrintAndLog("Options :"); |
ff9c043d |
20 | PrintAndLog(" <format> : format length 26|32|36|40"); |
50564be0 |
21 | PrintAndLog(" <Facility-Code> : 8-bit value facility code"); |
22 | PrintAndLog(" <Card Number> : 16-bit value card number"); |
23 | PrintAndLog(""); |
da952d12 |
24 | PrintAndLog("Sample : lf guard clone 26 123 11223"); |
50564be0 |
25 | return 0; |
26 | } |
27 | |
28 | int usage_lf_guard_sim(void) { |
29 | PrintAndLog("Enables simulation of Guardall card with specified card number."); |
30 | PrintAndLog("Simulation runs until the button is pressed or another USB command is issued."); |
31 | PrintAndLog("The facility-code is 8-bit and the card number is 16-bit. Larger values are truncated."); |
32 | PrintAndLog("Currently work only on 26bit"); |
33 | PrintAndLog(""); |
03d73c0b |
34 | PrintAndLog("Usage: lf guard sim <format> <Facility-Code> <Card-Number>"); |
50564be0 |
35 | PrintAndLog("Options :"); |
ff9c043d |
36 | PrintAndLog(" <format> : format length 26|32|36|40"); |
50564be0 |
37 | PrintAndLog(" <Facility-Code> : 8-bit value facility code"); |
38 | PrintAndLog(" <Card Number> : 16-bit value card number"); |
39 | PrintAndLog(""); |
03d73c0b |
40 | PrintAndLog("Sample : lf guard sim 26 123 11223"); |
50564be0 |
41 | return 0; |
42 | } |
43 | |
50564be0 |
44 | // Works for 26bits. |
ff9c043d |
45 | int GetGuardBits(uint8_t fmtlen, uint32_t fc, uint32_t cn, uint8_t *guardBits) { |
50564be0 |
46 | |
c728b2b4 |
47 | uint8_t xorKey = 0x66; |
0d2c5909 |
48 | uint8_t i; |
0d2c5909 |
49 | uint8_t pre[96]; |
ff9c043d |
50 | uint8_t rawbytes[12]; |
0d2c5909 |
51 | memset(pre, 0x00, sizeof(pre)); |
ff9c043d |
52 | memset(rawbytes, 0x00, sizeof(rawbytes)); |
50564be0 |
53 | |
ff9c043d |
54 | // add format length (decimal) |
55 | switch (fmtlen) { |
56 | case 32: { |
57 | rawbytes[1] = (32 << 2); |
58 | |
59 | break; |
60 | } |
61 | case 36: { |
62 | // FC = ((ByteStream[3] & 0x7F)<<7) | (ByteStream[4]>>1); |
63 | // Card = ((ByteStream[4]&1)<<19) | (ByteStream[5]<<11) | (ByteStream[6]<<3) | (ByteStream[7]>>5); |
64 | rawbytes[1] = (36 << 2); |
65 | // Get 26 wiegand from FacilityCode, CardNumber |
66 | uint8_t wiegand[34]; |
67 | memset(wiegand, 0x00, sizeof(wiegand)); |
68 | num_to_bytebits(fc, 8, wiegand); |
69 | num_to_bytebits(cn, 26, wiegand+8); |
70 | |
71 | // add wiegand parity bits (dest, source, len) |
72 | wiegand_add_parity(pre, wiegand, 34); |
73 | break; |
74 | } |
75 | case 40: { |
76 | rawbytes[1] = (40 << 2); |
77 | break; |
78 | } |
79 | case 26: |
80 | default: { |
81 | rawbytes[1] = (26 << 2); |
82 | // Get 26 wiegand from FacilityCode, CardNumber |
83 | uint8_t wiegand[24]; |
84 | memset(wiegand, 0x00, sizeof(wiegand)); |
85 | num_to_bytebits(fc, 8, wiegand); |
86 | num_to_bytebits(cn, 16, wiegand+8); |
87 | |
88 | // add wiegand parity bits (dest, source, len) |
89 | wiegand_add_parity(pre, wiegand, 24); |
90 | break; |
91 | } |
92 | } |
93 | // 2bit checksum, unknown today, |
94 | // these two bits are the last ones of rawbyte[1], hence the LSHIFT above. |
0d2c5909 |
95 | |
ff9c043d |
96 | |
0d2c5909 |
97 | // xor key |
98 | rawbytes[0] = xorKey; |
0d2c5909 |
99 | |
0d2c5909 |
100 | rawbytes[2] = 1; |
101 | rawbytes[3] = 0; |
50564be0 |
102 | |
0d2c5909 |
103 | // add wiegand to rawbytes |
104 | for (i = 0; i < 4; ++i) |
105 | rawbytes[i+4] = bytebits_to_byte( pre + (i*8), 8); |
50564be0 |
106 | |
0d2c5909 |
107 | if (g_debugMode) printf(" WIE | %s\n", sprint_hex(rawbytes, sizeof(rawbytes))); |
50564be0 |
108 | |
ff9c043d |
109 | |
0d2c5909 |
110 | // XOR (only works on wiegand stuff) |
111 | for (i = 1; i < 12; ++i) |
112 | rawbytes[i] ^= xorKey ; |
113 | |
114 | if (g_debugMode) printf(" XOR | %s \n", sprint_hex(rawbytes, sizeof(rawbytes))); |
115 | |
116 | // convert rawbytes to bits in pre |
117 | for (i = 0; i < 12; ++i) |
118 | num_to_bytebitsLSBF( rawbytes[i], 8, pre + (i*8)); |
119 | |
120 | if (g_debugMode) printf("\n Raw | %s \n", sprint_hex(rawbytes, sizeof(rawbytes))); |
121 | if (g_debugMode) printf(" Raw | %s\n", sprint_bin(pre, 64) ); |
122 | |
123 | // add spacer bit 0 every 4 bits, starting with index 0, |
07291f87 |
124 | // 12 bytes, 24 nibbles. 24+1 extra bites. 3bytes. ie 9bytes | 1byte xorkey, 8bytes rawdata (64bits, should be enough for a 40bit wiegand) |
0d2c5909 |
125 | addParity(pre, guardBits+6, 64, 5, 3); |
126 | |
127 | // preamble |
128 | guardBits[0] = 1; |
129 | guardBits[1] = 1; |
130 | guardBits[2] = 1; |
131 | guardBits[3] = 1; |
132 | guardBits[4] = 1; |
133 | guardBits[5] = 0; |
0d2c5909 |
134 | |
135 | if (g_debugMode) printf(" FIN | %s\n", sprint_bin(guardBits, 96) ); |
50564be0 |
136 | return 1; |
137 | } |
138 | |
139 | int CmdGuardRead(const char *Cmd) { |
140 | CmdLFRead("s"); |
42c235e7 |
141 | getSamples("12000", TRUE); |
50564be0 |
142 | return CmdG_Prox_II_Demod(""); |
143 | } |
144 | |
145 | int CmdGuardClone(const char *Cmd) { |
146 | |
147 | char cmdp = param_getchar(Cmd, 0); |
148 | if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_guard_clone(); |
149 | |
ff9c043d |
150 | uint32_t facilitycode = 0, cardnumber = 0, fc = 0, cn = 0, fmtlen = 0; |
50564be0 |
151 | uint8_t i; |
152 | uint8_t bs[96]; |
153 | memset(bs, 0x00, sizeof(bs)); |
154 | |
155 | //GuardProxII - compat mode, ASK/Biphase, data rate 64, 3 data blocks |
ff9c043d |
156 | uint32_t blocks[5] = {T55x7_MODULATION_BIPHASE | T55x7_BITRATE_RF_64 | 3 << T55x7_MAXBLOCK_SHIFT, 0, 0, 0, 0}; |
50564be0 |
157 | |
ff9c043d |
158 | if (param_getchar(Cmd, 3) == 'Q' || param_getchar(Cmd, 3) == 'q') |
159 | //t5555 (Q5) BITRATE = (RF-2)/2 (iceman) |
160 | blocks[0] = T5555_MODULATION_FSK2 | ((50-2)>>1) << T5555_BITRATE_SHIFT | 3 << T5555_MAXBLOCK_SHIFT; |
50564be0 |
161 | |
da952d12 |
162 | if (sscanf(Cmd, "%u %u %u", &fmtlen, &fc, &cn ) != 3) return usage_lf_guard_clone(); |
50564be0 |
163 | |
ff9c043d |
164 | fmtlen &= 0x7f; |
50564be0 |
165 | facilitycode = (fc & 0x000000FF); |
166 | cardnumber = (cn & 0x0000FFFF); |
167 | |
ff9c043d |
168 | if ( !GetGuardBits(fmtlen, facilitycode, cardnumber, bs)) { |
50564be0 |
169 | PrintAndLog("Error with tag bitstream generation."); |
170 | return 1; |
171 | } |
172 | |
173 | blocks[1] = bytebits_to_byte(bs,32); |
174 | blocks[2] = bytebits_to_byte(bs+32,32); |
175 | blocks[3] = bytebits_to_byte(bs+64,32); |
176 | |
177 | PrintAndLog("Preparing to clone Guardall to T55x7 with Facility Code: %u, Card Number: %u", facilitycode, cardnumber); |
178 | PrintAndLog("Blk | Data "); |
179 | PrintAndLog("----+------------"); |
180 | for ( i = 0; i<4; ++i ) |
42c235e7 |
181 | PrintAndLog(" %02d | 0x%08x", i, blocks[i]); |
50564be0 |
182 | |
0d2c5909 |
183 | UsbCommand resp; |
184 | UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}}; |
185 | |
186 | for ( i = 0; i<4; ++i ) { |
187 | c.arg[0] = blocks[i]; |
188 | c.arg[1] = i; |
189 | clearCommandBuffer(); |
190 | SendCommand(&c); |
42c235e7 |
191 | if (!WaitForResponseTimeout(CMD_ACK, &resp, T55XX_WRITE_TIMEOUT)){ |
0d2c5909 |
192 | PrintAndLog("Error occurred, device did not respond during write operation."); |
193 | return -1; |
194 | } |
195 | } |
50564be0 |
196 | return 0; |
197 | } |
198 | |
199 | int CmdGuardSim(const char *Cmd) { |
200 | |
201 | char cmdp = param_getchar(Cmd, 0); |
202 | if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_guard_sim(); |
203 | |
ff9c043d |
204 | uint32_t facilitycode = 0, cardnumber = 0, fc = 0, cn = 0, fmtlen = 0; |
07291f87 |
205 | uint8_t clock = 64, encoding = 2, separator = 0, invert = 0; |
50564be0 |
206 | |
207 | uint8_t bs[96]; |
07291f87 |
208 | memset(bs, 0x00, sizeof(bs)); |
50564be0 |
209 | |
03d73c0b |
210 | if (sscanf(Cmd, "%u %u %u", &fmtlen, &fc, &cn ) != 3) return usage_lf_guard_sim(); |
50564be0 |
211 | |
ff9c043d |
212 | fmtlen &= 0x7F; |
50564be0 |
213 | facilitycode = (fc & 0x000000FF); |
214 | cardnumber = (cn & 0x0000FFFF); |
215 | |
ff9c043d |
216 | if ( !GetGuardBits(fmtlen, facilitycode, cardnumber, bs)) { |
50564be0 |
217 | PrintAndLog("Error with tag bitstream generation."); |
218 | return 1; |
219 | } |
220 | |
221 | PrintAndLog("Simulating Guardall - Facility Code: %u, CardNumber: %u", facilitycode, cardnumber ); |
07291f87 |
222 | |
223 | // Guard uses: clk: 64, invert: 0, encoding: 2 (ASK Biphase) |
224 | uint64_t arg1, arg2; |
225 | arg1 = (clock << 8) | encoding; |
226 | arg2 = (invert << 8) | separator; |
227 | |
228 | uint8_t rawbytes[12]; |
229 | size_t size = sizeof(rawbytes); |
230 | for (uint8_t i=0; i < size; ++i){ |
231 | rawbytes[i] = bytebits_to_byte( bs + (i*8), 8); |
232 | } |
233 | |
50564be0 |
234 | UsbCommand c = {CMD_ASK_SIM_TAG, {arg1, arg2, size}}; |
07291f87 |
235 | memcpy(c.d.asBytes, rawbytes, size ); |
50564be0 |
236 | clearCommandBuffer(); |
237 | SendCommand(&c); |
238 | return 0; |
239 | } |
240 | |
241 | static command_t CommandTable[] = { |
242 | {"help", CmdHelp, 1, "This help"}, |
243 | {"read", CmdGuardRead, 0, "Attempt to read and extract tag data"}, |
0d2c5909 |
244 | {"clone", CmdGuardClone, 0, "<Facility-Code> <Card Number> clone Guardall tag"}, |
07291f87 |
245 | {"sim", CmdGuardSim, 0, "<Facility-Code> <Card Number> simulate Guardall tag"}, |
50564be0 |
246 | {NULL, NULL, 0, NULL} |
247 | }; |
248 | |
249 | int CmdLFGuard(const char *Cmd) { |
250 | clearCommandBuffer(); |
251 | CmdsParse(CommandTable, Cmd); |
252 | return 0; |
253 | } |
254 | |
255 | int CmdHelp(const char *Cmd) { |
256 | CmdsHelp(CommandTable); |
257 | return 0; |
258 | } |