56bbb25a |
1 | //----------------------------------------------------------------------------- |
2 | // |
3 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, |
4 | // at your option, any later version. See the LICENSE.txt file for the text of |
5 | // the license. |
6 | //----------------------------------------------------------------------------- |
7 | // Low frequency NEDAP tag commands |
8 | //----------------------------------------------------------------------------- |
9 | #include <string.h> |
10 | #include <inttypes.h> |
11 | #include "cmdlfnedap.h" |
12 | static int CmdHelp(const char *Cmd); |
13 | |
14 | int usage_lf_nedap_clone(void){ |
15 | PrintAndLog("clone a NEDAP tag to a T55x7 tag."); |
16 | PrintAndLog(""); |
17 | PrintAndLog("Usage: lf nedap clone <Card-Number>"); |
18 | PrintAndLog("Options :"); |
19 | PrintAndLog(" <Card Number> : 24-bit value card number"); |
20 | // PrintAndLog(" Q5 : optional - clone to Q5 (T5555) instead of T55x7 chip"); |
21 | PrintAndLog(""); |
22 | PrintAndLog("Sample : lf nedap clone 112233"); |
23 | return 0; |
24 | } |
25 | |
26 | int usage_lf_nedap_sim(void) { |
27 | PrintAndLog("Enables simulation of NEDAP card with specified card number."); |
28 | PrintAndLog("Simulation runs until the button is pressed or another USB command is issued."); |
29 | PrintAndLog(""); |
30 | PrintAndLog("Usage: lf nedap sim <Card-Number>"); |
31 | PrintAndLog("Options :"); |
32 | PrintAndLog(" <Card Number> : 24-bit value card number"); |
33 | PrintAndLog(""); |
34 | PrintAndLog("Sample : lf nedap sim 112233"); |
35 | return 0; |
36 | } |
37 | |
38 | int GetNedapBits(uint32_t cn, uint8_t *nedapBits) { |
39 | |
40 | uint8_t pre[128]; |
41 | memset(pre, 0x00, sizeof(pre)); |
42 | |
43 | // preamble 1111 1111 10 = 0XF8 |
44 | num_to_bytebits(0xF8, 10, pre); |
45 | |
46 | // fixed tagtype code? 0010 1101 = 0x2D |
47 | num_to_bytebits(0x2D, 8, pre+10); |
48 | |
49 | // 46 encrypted bits - UNKNOWN ALGO |
50 | // -- 16 bits checksum. Should be 4x4 checksum, based on UID and 2 constant values. |
51 | // -- 30 bits undocumented? |
52 | num_to_bytebits(cn, 46, pre+18); |
53 | |
54 | //----from this part, the UID in clear text, with a 1bit ZERO as separator between bytes. |
55 | pre[64] = 0; |
56 | |
2d1885f1 |
57 | // cardnumber (uid) |
56bbb25a |
58 | num_to_bytebits(cn, 24, pre+64); |
59 | |
60 | pre[73] = 0; |
61 | pre[82] = 0; |
62 | pre[91] = 0; |
63 | pre[100] = 0; |
64 | pre[109] = 0; |
65 | pre[118] = 0; |
66 | |
67 | // add paritybits (bitsource, dest, sourcelen, paritylen, parityType (odd, even,) |
68 | addParity(pre+64, pre+64, 128, 8, 1); |
c71f4da9 |
69 | |
56bbb25a |
70 | //1111111110001011010000010110100011001001000010110101001101011001000110011010010000000000100001110001001000000001000101011100111 |
71 | return 1; |
72 | } |
2d1885f1 |
73 | /* |
74 | - UID: 001630 |
75 | - i: 4071 |
76 | - Checksum2 BE21 |
77 | */ |
c71f4da9 |
78 | //GetParity( uint8_t *bits, uint8_t type, int length) |
79 | |
2d1885f1 |
80 | //NEDAP demod - ASK/Biphase (or Diphase), RF/64 with preamble of 1111111110 (always a 128 bit data stream) |
56bbb25a |
81 | //print NEDAP Prox ID, encoding, encrypted ID, |
c71f4da9 |
82 | |
83 | int CmdLFNedapDemod(const char *Cmd) { |
56bbb25a |
84 | //raw ask demod no start bit finding just get binary from wave |
85 | uint8_t BitStream[MAX_GRAPH_TRACE_LEN]={0}; |
86 | size_t size = getFromGraphBuf(BitStream); |
87 | if (size==0) return 0; |
88 | |
96faed21 |
89 | //get binary from ask wave |
c71f4da9 |
90 | if (!ASKbiphaseDemod("0 64 0 0", FALSE)) { |
96faed21 |
91 | if (g_debugMode) PrintAndLog("Error NEDAP: ASKbiphaseDemod failed"); |
92 | return 0; |
93 | } |
d34a0b0c |
94 | size = DemodBufferLen; |
c71f4da9 |
95 | int idx = NedapDemod(DemodBuffer, &size); |
56bbb25a |
96 | if (idx < 0){ |
97 | if (g_debugMode){ |
2d1885f1 |
98 | // if (idx == -5) |
99 | // PrintAndLog("DEBUG: Error - not enough samples"); |
100 | // else if (idx == -1) |
101 | // PrintAndLog("DEBUG: Error - only noise found"); |
102 | // else if (idx == -2) |
103 | // PrintAndLog("DEBUG: Error - problem during ASK/Biphase demod"); |
104 | if (idx == -3) |
56bbb25a |
105 | PrintAndLog("DEBUG: Error - Size not correct: %d", size); |
106 | else if (idx == -4) |
107 | PrintAndLog("DEBUG: Error - NEDAP preamble not found"); |
108 | else |
109 | PrintAndLog("DEBUG: Error - idx: %d",idx); |
110 | } |
111 | return 0; |
112 | } |
113 | |
2d1885f1 |
114 | /* Index map E E |
115 | preamble enc tag type encrypted uid P d 33 d 90 d 04 d 71 d 40 d 45 d E7 P |
116 | 1111111110 00101101000001011010001100100100001011010100110101100 1 0 00110011 0 10010000 0 00000100 0 01110001 0 01000000 0 01000101 0 11100111 1 |
532bcd71 |
117 | uid2 uid1 uid0 I I R R |
2d1885f1 |
118 | 1111111110 00101101000001011010001100100100001011010100110101100 1 |
119 | |
120 | 0 00110011 |
121 | 0 10010000 |
122 | 0 00000100 |
123 | 0 01110001 |
124 | 0 01000000 |
125 | 0 01000101 |
126 | 0 11100111 |
127 | 1 |
128 | |
56bbb25a |
129 | Tag ID is 049033 |
130 | I = Identical on all tags |
131 | R = Random ? |
132 | UID2, UID1, UID0 == card number |
532bcd71 |
133 | |
56bbb25a |
134 | */ |
56bbb25a |
135 | //get raw ID before removing parities |
2d1885f1 |
136 | uint32_t raw[4] = {0,0,0,0}; |
137 | raw[0] = bytebits_to_byte(DemodBuffer+idx+96,32); |
138 | raw[1] = bytebits_to_byte(DemodBuffer+idx+64,32); |
139 | raw[2] = bytebits_to_byte(DemodBuffer+idx+32,32); |
140 | raw[3] = bytebits_to_byte(DemodBuffer+idx,32); |
c71f4da9 |
141 | setDemodBuf(DemodBuffer,128,idx); |
56bbb25a |
142 | |
2d1885f1 |
143 | uint8_t firstParity = GetParity( DemodBuffer, EVEN, 63); |
144 | if ( firstParity != DemodBuffer[63] ) { |
145 | PrintAndLog("1st 64bit parity check failed: %d|%d ", DemodBuffer[63], firstParity); |
146 | //return 0; |
532bcd71 |
147 | } |
148 | |
2d1885f1 |
149 | uint8_t secondParity = GetParity( DemodBuffer+64, EVEN, 63); |
150 | if ( secondParity != DemodBuffer[127] ) { |
151 | PrintAndLog("2st 64bit parity check failed: %d|%d ", DemodBuffer[127], secondParity); |
152 | //return 0; |
153 | } |
532bcd71 |
154 | |
56bbb25a |
155 | // ok valid card found! |
2d1885f1 |
156 | uint32_t uid = 0; |
157 | uid = bytebits_to_byte(DemodBuffer+65, 8); |
158 | uid |= bytebits_to_byte(DemodBuffer+74, 8) << 8; |
159 | uid |= bytebits_to_byte(DemodBuffer+83, 8) << 16; |
160 | |
161 | uint16_t two = 0; |
162 | two = bytebits_to_byte(DemodBuffer+92, 8); |
163 | two |= bytebits_to_byte(DemodBuffer+101, 8) << 8; |
56bbb25a |
164 | |
2d1885f1 |
165 | uint16_t chksum2 = 0; |
166 | chksum2 = bytebits_to_byte(DemodBuffer+110, 8); |
167 | chksum2 |= bytebits_to_byte(DemodBuffer+119, 8) << 8; |
168 | |
169 | PrintAndLog("NEDAP ID Found - Raw: %08x%08x%08x%08x", raw[3], raw[2], raw[1], raw[0]); |
170 | PrintAndLog(" - UID: %06X", uid); |
171 | PrintAndLog(" - i: %04X", two); |
172 | PrintAndLog(" - Checksum2 %04X", chksum2); |
173 | |
56bbb25a |
174 | if (g_debugMode){ |
175 | PrintAndLog("DEBUG: idx: %d, Len: %d, Printing Demod Buffer:", idx, 128); |
176 | printDemodBuff(); |
2d1885f1 |
177 | PrintAndLog("BIN:\n%s", sprint_bin_break( DemodBuffer, 128, 64) ); |
56bbb25a |
178 | } |
c71f4da9 |
179 | |
56bbb25a |
180 | return 1; |
181 | } |
c71f4da9 |
182 | /* |
2d1885f1 |
183 | configuration |
184 | lf t55xx wr b 0 d 00170082 |
185 | |
186 | 1) uid 049033 |
c71f4da9 |
187 | lf t55 wr b 1 d FF8B4168 |
188 | lf t55 wr b 2 d C90B5359 |
189 | lf t55 wr b 3 d 19A40087 |
190 | lf t55 wr b 4 d 120115CF |
56bbb25a |
191 | |
2d1885f1 |
192 | 2) uid 001630 |
c71f4da9 |
193 | lf t55 wr b 1 d FF8B6B20 |
194 | lf t55 wr b 2 d F19B84A3 |
195 | lf t55 wr b 3 d 18058007 |
196 | lf t55 wr b 4 d 1200857C |
197 | |
2d1885f1 |
198 | 3) uid 39feff |
199 | lf t55xx wr b 1 d ffbfa73e |
200 | lf t55xx wr b 2 d 4c0003ff |
201 | lf t55xx wr b 3 d ffbfa73e |
202 | lf t55xx wr b 4 d 4c0003ff |
203 | |
c71f4da9 |
204 | */ |
56bbb25a |
205 | |
206 | int CmdLFNedapRead(const char *Cmd) { |
207 | CmdLFRead("s"); |
208 | getSamples("30000",false); |
c71f4da9 |
209 | return CmdLFNedapDemod(""); |
56bbb25a |
210 | } |
211 | /* |
212 | int CmdLFNedapClone(const char *Cmd) { |
213 | |
214 | char cmdp = param_getchar(Cmd, 0); |
215 | if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_nedap_clone(); |
216 | |
217 | uint32_t cardnumber=0, cn = 0; |
218 | uint32_t blocks[5]; |
219 | uint8_t i; |
220 | uint8_t bs[128]; |
221 | memset(bs, 0x00, sizeof(bs)); |
222 | |
223 | if (sscanf(Cmd, "%u", &cn ) != 1) return usage_lf_nedap_clone(); |
224 | |
225 | cardnumber = (cn & 0x00FFFFFF); |
226 | |
227 | if ( !GetNedapBits(cardnumber, bs)) { |
228 | PrintAndLog("Error with tag bitstream generation."); |
229 | return 1; |
230 | } |
231 | |
232 | ((ASK/biphase data rawdemod ab 0 64 1 0 |
233 | //NEDAP - compat mode, ASK/Biphase, data rate 64, 4 data blocks |
234 | blocks[0] = T55x7_MODULATION_BIPHASE | T55x7_BITRATE_RF_64 | 4<<T55x7_MAXBLOCK_SHIFT; |
235 | |
236 | if (param_getchar(Cmd, 3) == 'Q' || param_getchar(Cmd, 3) == 'q') |
890ae3dd |
237 | //t5555 (Q5) BITRATE = (RF-2)/2 (iceman) |
56bbb25a |
238 | blocks[0] = T5555_MODULATION_BIPHASE | T5555_INVERT_OUTPUT | 64<<T5555_BITRATE_SHIFT | 4<<T5555_MAXBLOCK_SHIFT; |
239 | |
240 | blocks[1] = bytebits_to_byte(bs,32); |
241 | blocks[2] = bytebits_to_byte(bs+32,32); |
242 | blocks[3] = bytebits_to_byte(bs+64,32); |
243 | blocks[4] = bytebits_to_byte(bs+96,32); |
244 | |
245 | PrintAndLog("Preparing to clone NEDAP to T55x7 with card number: %u", cardnumber); |
246 | PrintAndLog("Blk | Data "); |
247 | PrintAndLog("----+------------"); |
248 | for ( i = 0; i<5; ++i ) |
249 | PrintAndLog(" %02d | %08" PRIx32, i, blocks[i]); |
250 | |
251 | UsbCommand resp; |
252 | UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {0,0,0}}; |
253 | |
254 | for ( i = 0; i<5; ++i ) { |
255 | c.arg[0] = blocks[i]; |
256 | c.arg[1] = i; |
257 | clearCommandBuffer(); |
258 | SendCommand(&c); |
259 | if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)){ |
260 | PrintAndLog("Error occurred, device did not respond during write operation."); |
261 | return -1; |
262 | } |
263 | } |
264 | return 0; |
265 | } |
266 | */ |
267 | |
268 | int CmdLFNedapSim(const char *Cmd) { |
269 | |
270 | char cmdp = param_getchar(Cmd, 0); |
271 | if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_nedap_sim(); |
272 | |
273 | uint32_t cardnumber = 0, cn = 0; |
274 | |
275 | uint8_t bs[128]; |
276 | size_t size = sizeof(bs); |
277 | memset(bs, 0x00, size); |
278 | |
279 | // NEDAP, Bihase = 2, clock 64, inverted, |
280 | uint8_t encoding = 2, separator = 0, clk=64, invert=1; |
281 | uint16_t arg1, arg2; |
282 | arg1 = clk << 8 | encoding; |
283 | arg2 = invert << 8 | separator; |
284 | |
285 | if (sscanf(Cmd, "%u", &cn ) != 2) return usage_lf_nedap_sim(); |
286 | cardnumber = (cn & 0x00FFFFFF); |
287 | |
288 | if ( !GetNedapBits(cardnumber, bs)) { |
289 | PrintAndLog("Error with tag bitstream generation."); |
290 | return 1; |
291 | } |
292 | |
293 | PrintAndLog("Simulating Nedap - CardNumber: %u", cardnumber ); |
294 | |
295 | UsbCommand c = {CMD_ASK_SIM_TAG, {arg1, arg2, size}}; |
296 | memcpy(c.d.asBytes, bs, size); |
297 | clearCommandBuffer(); |
298 | SendCommand(&c); |
299 | return 0; |
300 | } |
301 | |
812513bf |
302 | |
303 | |
c71f4da9 |
304 | int CmdLFNedapChk(const char *Cmd){ |
305 | |
532bcd71 |
306 | uint8_t data[256] = { 0x30, 0x16, 0x00, 0x71, 0x40, 0x21, 0xBE}; |
c71f4da9 |
307 | int len = 0; |
308 | param_gethex_ex(Cmd, 0, data, &len); |
309 | |
310 | len = ( len == 0 ) ? 5 : len>>1; |
311 | |
312 | PrintAndLog("Input: [%d] %s", len, sprint_hex(data, len)); |
313 | |
812513bf |
314 | //uint8_t last = GetParity(data, EVEN, 62); |
315 | //PrintAndLog("TEST PARITY:: %d | %d ", DemodBuffer[62], last); |
532bcd71 |
316 | |
c71f4da9 |
317 | uint8_t cl = 0x1D, ch = 0x1D, carry = 0; |
318 | uint8_t al, bl, temp; |
319 | |
320 | for (int i = 0; i < len; ++i){ |
321 | al = data[i]; |
322 | for (int j = 8; j > 0; --j) { |
323 | |
324 | bl = al ^ ch; |
325 | //printf("BL %02x | CH %02x \n", al, ch); |
326 | |
327 | carry = (cl & 0x80) ? 1 : 0; |
328 | cl <<= 1; |
329 | |
330 | temp = (ch & 0x80) ? 1 : 0; |
331 | ch = (ch << 1) | carry; |
332 | carry = temp; |
333 | |
334 | carry = (al & 0x80) ? 1 : 0; |
335 | al <<= 1; |
336 | |
337 | carry = (bl & 0x80) ? 1 : 0; |
338 | bl <<= 1; |
339 | |
340 | if (carry) { |
341 | cl ^= 0x21; |
342 | ch ^= 0x10; |
343 | } |
344 | } |
345 | } |
346 | |
347 | PrintAndLog("Nedap checksum: [ 0x21, 0xBE ] %x", ((ch << 8) | cl) ); |
348 | return 0; |
349 | } |
350 | |
351 | |
56bbb25a |
352 | static command_t CommandTable[] = { |
353 | {"help", CmdHelp, 1, "This help"}, |
c71f4da9 |
354 | {"read", CmdLFNedapRead, 0, "Attempt to read and extract tag data"}, |
355 | // {"clone", CmdLFNedapClone,0, "<Card Number> clone nedap tag"}, |
356 | {"sim", CmdLFNedapSim, 0, "<Card Number> simulate nedap tag"}, |
357 | {"chk", CmdLFNedapChk, 1, "Calculate Nedap Checksum <uid bytes>"}, |
56bbb25a |
358 | {NULL, NULL, 0, NULL} |
359 | }; |
360 | |
361 | int CmdLFNedap(const char *Cmd) { |
362 | clearCommandBuffer(); |
363 | CmdsParse(CommandTable, Cmd); |
364 | return 0; |
365 | } |
366 | |
367 | int CmdHelp(const char *Cmd) { |
368 | CmdsHelp(CommandTable); |
369 | return 0; |
370 | } |