]>
cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfhid.c
02c2fdb789af32ea7ef948b4ea13c81987987add
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // Low frequency HID commands
9 //-----------------------------------------------------------------------------
13 #include "proxmark3.h"
16 #include "cmdparser.h"
22 static int CmdHelp(const char *Cmd
);
24 int usage_lf_hid_wiegand(void){
25 PrintAndLog("Usage: lf hid wiegand [h] [oem] [FacilityCode] [cardnumber]");
26 PrintAndLog("This command converts FC/Cardnum to wiegand code");
27 PrintAndLog("Options:");
28 PrintAndLog(" h - This help");
29 PrintAndLog(" oem - Oem number");
30 PrintAndLog(" facilitynum - Facility number");
31 PrintAndLog(" cardnum - Card number");
32 PrintAndLog("Examples:");
33 PrintAndLog(" lf hid wiegand 0 101 2001");
36 int usage_lf_hid_brute(void){
37 PrintAndLog("Enables bruteforce of HID readers with specified facility-code.");
38 PrintAndLog("Different formatlength is supported");
39 PrintAndLog("This is a incremental attack against reader.");
41 PrintAndLog("Usage: lf hid brute <formatlength> <Facility-Code>");
42 PrintAndLog("Options :");
43 PrintAndLog(" <formatlength> : 26|33|34|35|37|40|44|84 ");
44 PrintAndLog(" <Facility-Code> : 8-bit value HID facility code");
46 PrintAndLog("Sample : lf hid brute 26 224");
50 int CmdHIDDemod(const char *Cmd)
52 if (GraphTraceLen < 4800) {
53 PrintAndLog("too short; need at least 4800 samples");
58 for (int i = 0; i < GraphTraceLen; ++i) {
59 if (GraphBuffer[i] < 0) {
69 int CmdHIDDemodFSK(const char *Cmd
) {
70 int findone
= ( Cmd
[0] == '1' ) ? 1 : 0;
71 UsbCommand c
= {CMD_HID_DEMOD_FSK
, {findone
, 0 , 0}};
77 int CmdHIDSim(const char *Cmd
) {
78 unsigned int hi
= 0, lo
= 0;
81 while (sscanf(&Cmd
[i
++], "%1x", &n
) == 1) {
82 hi
= (hi
<< 4) | (lo
>> 28);
83 lo
= (lo
<< 4) | (n
& 0xf);
86 PrintAndLog("Emulating tag with ID %x%16x", hi
, lo
);
87 PrintAndLog("Press pm3-button to abort simulation");
89 UsbCommand c
= {CMD_HID_SIM_TAG
, {hi
, lo
, 0}};
95 int CmdHIDClone(const char *Cmd
) {
96 unsigned int hi2
= 0, hi
= 0, lo
= 0;
100 if (strchr(Cmd
,'l') != 0) {
101 while (sscanf(&Cmd
[i
++], "%1x", &n
) == 1) {
102 hi2
= (hi2
<< 4) | (hi
>> 28);
103 hi
= (hi
<< 4) | (lo
>> 28);
104 lo
= (lo
<< 4) | (n
& 0xf);
107 PrintAndLog("Cloning tag with long ID %x%08x%08x", hi2
, hi
, lo
);
111 while (sscanf(&Cmd
[i
++], "%1x", &n
) == 1) {
112 hi
= (hi
<< 4) | (lo
>> 28);
113 lo
= (lo
<< 4) | (n
& 0xf);
116 PrintAndLog("Cloning tag with ID %x%08x", hi
, lo
);
122 c
.cmd
= CMD_HID_CLONE_TAG
;
127 clearCommandBuffer();
132 static void getParity26(uint32_t *hi
, uint32_t *lo
){
136 for (i
= 24;i
>= 13;i
--)
137 result
^= (*lo
>> i
) & 1;
138 // even parity 26th bit
143 for (i
= 12;i
>= 1;i
--)
144 result
^= (*lo
>> i
) & 1;
147 static void getParity33(uint32_t *hi
, uint32_t *lo
){
150 static void getParity34(uint32_t *hi
, uint32_t *lo
){
155 for (i
= 7;i
>= 0;i
--)
156 result
^= (*hi
>> i
) & i
;
157 for (i
= 31;i
>= 24;i
--)
158 result
^= (*lo
>> i
) & 1;
164 for (i
= 23;i
>= 1;i
--)
165 result
^= (*lo
>> i
) & 1;
169 static void getParity35(uint32_t *hi
, uint32_t *lo
){
172 static void getParity37S(uint32_t *hi
,uint32_t *lo
){
177 for (i
= 4; i
>= 0; i
--)
178 result
^= (*hi
>> i
) & 1;
180 for (i
= 31; i
>= 20; i
--)
181 result
^= (*lo
>> i
) & 1;
187 for (i
= 19; i
>= 1; i
--)
188 result
^= (*lo
>> i
) & 1;
192 static void getParity37H(uint32_t *hi
, uint32_t *lo
){
197 for (i
= 4;i
>= 0;i
--)
198 result
^= (*hi
>> i
) & 1;
199 for (i
= 31;i
>= 20;i
--)
200 result
^= (*lo
>> i
) & 1;
205 for (i
= 19;i
>= 1;i
--)
206 result
^= (*lo
>> i
) & 1;
210 static void calc26(uint16_t fc
, uint32_t cardno
, uint32_t *hi
, uint32_t *lo
){
211 *lo
= ((cardno
& 0xFFFF) << 1) | ((fc
& 0xFF) << 17) | (1 << 26);
214 static void calc33(uint16_t fc
, uint32_t cardno
, uint32_t *hi
, uint32_t *lo
){
217 static void calc34(uint16_t fc
, uint32_t cardno
, uint32_t *hi
, uint32_t *lo
){
218 // put card number first bit 1 .. 20 //
219 *lo
= ((cardno
& 0X000F7FFF) << 1) | ((fc
& 0XFFFF) << 17);
220 // set bit format for less than 37 bit format
221 *hi
= (1 << 5) | (fc
>> 15);
223 static void calc35(uint16_t fc
, uint32_t cardno
, uint32_t *hi
, uint32_t *lo
){
224 *lo
= ((cardno
& 0xFFFFF) << 1) | fc
<< 21;
225 *hi
= (1 << 5) | ((fc
>> 11) & 1);
227 static void calc37S(uint16_t fc
, uint32_t cardno
, uint32_t *hi
, uint32_t *lo
){
228 // FC 2 - 17 - 16 bit
229 // cardno 18 - 36 - 19 bit
234 *lo
= ((fc
<< 20) | (cardno
& 0x7FFFF) << 1);
237 static void calc37H(uint64_t cardno
, uint32_t *hi
, uint32_t *lo
){
239 // cardno 1-35 34 bits
240 // Even Parity 0th bit 1-18
241 // Odd Parity 36th bit 19-35
242 cardno
= (cardno
& 0x00000003FFFFFFFF);
244 *hi
= (cardno
>> 31);
246 static void calc40(uint64_t cardno
, uint32_t *hi
, uint32_t *lo
){
247 cardno
= (cardno
& 0xFFFFFFFFFF);
248 *lo
= ((cardno
& 0xFFFFFFFF) << 1 );
249 *hi
= (cardno
>> 31);
252 static void calcWiegand(uint8_t fmtlen
, uint16_t fc
, uint64_t cardno
, uint32_t *hi
, uint32_t *lo
){
254 uint32_t cn
= (cardno
& 0xFFFFFFFF);
257 calc26(fc
, cn
, hi
, lo
);
262 calc33(fc
, cn
, hi
, lo
);
267 calc34(fc
, cn
, hi
, lo
);
272 calc35(fc
, cn
, hi
, lo
);
277 calc37S(fc
, cn
, hi
, lo
);
278 getParity37S(hi
, lo
);
283 getParity37H(hi
, lo
);
286 case 40 : calc40(cardno
, hi
, lo
); break;
292 int CmdHIDWiegand(const char *Cmd
) {
294 uint32_t fc
, lo
= 0, hi
= 0;
295 uint64_t cardnum
= 0;
297 uint8_t ctmp
= param_getchar(Cmd
, 0);
298 if ( strlen(Cmd
) < 0 || strlen(Cmd
) < 3 || ctmp
== 'H' || ctmp
== 'h' ) return usage_lf_hid_wiegand();
300 oem
= param_get8(Cmd
, 0);
301 fc
= param_get32ex(Cmd
, 1, 0, 10);
302 cardnum
= param_get64ex(Cmd
, 2, 0, 10);
304 uint8_t ftmlen
[] = {26,33,34,35,37,38,40};
305 for (uint8_t i
= 0; i
< sizeof(ftmlen
); i
++){
306 calcWiegand( ftmlen
[i
], fc
, cardnum
, &hi
, &lo
);
307 PrintAndLog("HID %d bit | FC: %d CN: %llu | Wiegand Code: %08X%08X", ftmlen
[i
], fc
, cardnum
, hi
, lo
);
312 int CmdHIDBrute(const char *Cmd
){
315 uint8_t fc
= 0, fmtlen
= 0;
316 uint32_t hi
= 0, lo
= 0;
318 UsbCommand c
= {CMD_HID_SIM_TAG
, {0, 0, 0}};
320 char cmdp
= param_getchar(Cmd
, 0);
321 if (strlen(Cmd
) > 2 || strlen(Cmd
) == 0 || cmdp
== 'h' || cmdp
== 'H') return usage_lf_hid_brute();
323 fmtlen
= param_get8(Cmd
, 0);
338 if ( error
) return usage_lf_hid_brute();
340 fc
= param_get8(Cmd
, 1);
341 if ( fc
== 0) return usage_lf_hid_brute();
343 PrintAndLog("Bruteforceing HID Reader");
344 PrintAndLog("Press pm3-button to abort simulation or run another command");
346 for ( uint16_t cn
= 1; cn
< 0xFFFF; ++cn
){
348 PrintAndLog("aborted via keyboard!");
353 clearCommandBuffer();
358 calcWiegand( fmtlen
, fc
, cn
, &hi
, &lo
);
362 clearCommandBuffer();
365 PrintAndLog("Trying FC: %u; CN: %u", fc
, cn
);
372 static command_t CommandTable
[] = {
373 {"help", CmdHelp
, 1, "This help"},
374 //{"demod", CmdHIDDemod, 1, "Demodulate HID Prox Card II (not optimal)"},
375 {"fskdemod", CmdHIDDemodFSK
, 0, "['1'] Realtime HID FSK demodulator (option '1' for one tag only)"},
376 {"sim", CmdHIDSim
, 0, "<ID> -- HID tag simulator"},
377 {"clone", CmdHIDClone
, 0, "<ID> ['l'] -- Clone HID to T55x7 (tag must be in antenna)(option 'l' for 84bit ID)"},
378 {"wiegand", CmdHIDWiegand
, 1, "<oem> <fmtlen> <fc> <cardnum> -- convert facilitycode, cardnumber to Wiegand code"},
379 {NULL
, NULL
, 0, NULL
}
382 int CmdLFHID(const char *Cmd
) {
383 CmdsParse(CommandTable
, Cmd
);
387 int CmdHelp(const char *Cmd
) {
388 CmdsHelp(CommandTable
);