]>
cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfawid.c
1 //-----------------------------------------------------------------------------
2 // Authored by Craig Young <cyoung@tripwire.com> based on cmdlfhid.c structure
4 // cmdlfhid.c is Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
9 //-----------------------------------------------------------------------------
10 // Low frequency AWID26/50 commands
11 //-----------------------------------------------------------------------------
12 #include "cmdlfawid.h" // AWID function declarations
14 static int CmdHelp(const char *Cmd
);
16 int usage_lf_awid_fskdemod(void) {
17 PrintAndLog("Enables AWID compatible reader mode printing details of scanned AWID26 or AWID50 tags.");
18 PrintAndLog("By default, values are printed and logged until the button is pressed or another USB command is issued.");
19 PrintAndLog("If the [1] option is provided, reader mode is exited after reading a single AWID card.");
21 PrintAndLog("Usage: lf awid fskdemod [h] [1]");
22 PrintAndLog("Options:");
23 PrintAndLog(" h : This help");
24 PrintAndLog(" 1 : (optional) stop after reading a single card");
26 PrintAndLog("Samples:");
27 PrintAndLog(" lf awid fskdemod");
28 PrintAndLog(" lf awid fskdemod 1");
32 int usage_lf_awid_sim(void) {
33 PrintAndLog("Enables simulation of AWID card with specified facility-code and card number.");
34 PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
36 PrintAndLog("Usage: lf awid sim [h] <format> <facility-code> <card-number>");
37 PrintAndLog("Options:");
38 PrintAndLog(" h : This help");
39 PrintAndLog(" <format> : format length 26|34|37|50");
40 PrintAndLog(" <facility-code> : 8|16bit value facility code");
41 PrintAndLog(" <card number> : 16|32-bit value card number");
43 PrintAndLog("Samples:");
44 PrintAndLog(" lf awid sim 26 224 1337");
45 PrintAndLog(" lf awid sim 50 2001 13371337");
49 int usage_lf_awid_clone(void) {
50 PrintAndLog("Enables cloning of AWID card with specified facility-code and card number onto T55x7.");
51 PrintAndLog("The T55x7 must be on the antenna when issuing this command. T55x7 blocks are calculated and printed in the process.");
53 PrintAndLog("Usage: lf awid clone [h] <format> <facility-code> <card-number> [Q5]");
54 PrintAndLog("Options:");
55 PrintAndLog(" h : This help");
56 PrintAndLog(" <format> : format length 26|34|37|50");
57 PrintAndLog(" <facility-code> : 8|16bit value facility code");
58 PrintAndLog(" <card number> : 16|32-bit value card number");
59 PrintAndLog(" Q5 : optional - clone to Q5 (T5555) instead of T55x7 chip");
61 PrintAndLog("Samples:");
62 PrintAndLog(" lf awid clone 26 224 1337");
63 PrintAndLog(" lf awid clone 50 2001 13371337");
67 int usage_lf_awid_brute(void){
68 PrintAndLog("Enables bruteforce of AWID reader with specified facility-code.");
69 PrintAndLog("This is a attack against reader. if cardnumber is given, it starts with it and goes up / down one step");
70 PrintAndLog("if cardnumber is not given, it starts with 1 and goes up to 65535");
72 PrintAndLog("Usage: lf awid brute [h] a <format> f <facility-code> c <cardnumber> d <delay>");
73 PrintAndLog("Options:");
74 PrintAndLog(" h : This help");
75 PrintAndLog(" a <format> : format length 26|50");
76 PrintAndLog(" f <facility-code> : 8|16bit value facility code");
77 PrintAndLog(" c <cardnumber> : (optional) cardnumber to start with, max 65535");
78 PrintAndLog(" d <delay> : delay betweens attempts in ms. Default 1000ms");
80 PrintAndLog("Samples:");
81 PrintAndLog(" lf awid brute a 26 f 224");
82 PrintAndLog(" lf awid brute a 50 f 2001 d 2000");
83 PrintAndLog(" lf awid brute a 50 f 2001 c 200 d 2000");
87 static int sendPing(void){
88 UsbCommand ping
= {CMD_PING
, {1, 2, 3}};
94 if (WaitForResponseTimeout(CMD_ACK
, &resp
, 1000))
99 static bool sendTry(uint8_t fmtlen
, uint32_t fc
, uint32_t cn
, uint32_t delay
, uint8_t *bs
, size_t bs_len
){
101 PrintAndLog("Trying FC: %u; CN: %u", fc
, cn
);
102 if ( !getAWIDBits(fmtlen
, fc
, cn
, bs
)) {
103 PrintAndLog("Error with tag bitstream generation.");
107 uint64_t arg1
= (10<<8) + 8; // fcHigh = 10, fcLow = 8
108 uint64_t arg2
= 50; // clk RF/50 invert=0
109 UsbCommand c
= {CMD_FSK_SIM_TAG
, {arg1
, arg2
, bs_len
}};
110 memcpy(c
.d
.asBytes
, bs
, bs_len
);
111 clearCommandBuffer();
118 int CmdAWIDDemodFSK(const char *Cmd
) {
120 if (Cmd
[0] == 'h' || Cmd
[0] == 'H') return usage_lf_awid_fskdemod();
121 uint8_t findone
= (Cmd
[0] == '1') ? 1 : 0;
122 UsbCommand c
= {CMD_AWID_DEMOD_FSK
, {findone
, 0, 0}};
123 clearCommandBuffer();
128 int CmdAWIDRead(const char *Cmd
) {
130 getSamples("12000", TRUE
);
131 return CmdFSKdemodAWID(Cmd
);
134 //refactored by marshmellow
135 int getAWIDBits(uint8_t fmtlen
, uint32_t fc
, uint32_t cn
, uint8_t *bits
) {
137 // the return bits, preamble 0000 0001
141 memset(pre
, 0, sizeof(pre
));
144 num_to_bytebits(fmtlen
, 8, pre
);
146 // add facilitycode, cardnumber and wiegand parity bits
150 num_to_bytebits(fc
, 8, wiegand
);
151 num_to_bytebits(cn
, 16, wiegand
+8);
152 wiegand_add_parity(pre
+8, wiegand
, sizeof(wiegand
));
157 num_to_bytebits(fc
, 8, wiegand
);
158 num_to_bytebits(cn
, 24, wiegand
+8);
159 wiegand_add_parity(pre
+8, wiegand
, sizeof(wiegand
));
164 num_to_bytebits(fc
, 13, wiegand
);
165 num_to_bytebits(cn
, 18, wiegand
+13);
166 wiegand_add_parity(pre
+8, wiegand
, sizeof(wiegand
));
171 num_to_bytebits(fc
, 16, wiegand
);
172 num_to_bytebits(cn
, 32, wiegand
+16);
173 wiegand_add_parity(pre
+8, wiegand
, sizeof(wiegand
));
178 // add AWID 4bit parity
179 size_t bitLen
= addParity(pre
, bits
+8, 66, 4, 1);
181 if (bitLen
!= 88) return 0;
185 static void verify_values(uint8_t *fmtlen
, uint32_t *fc
, uint32_t *cn
){
188 if ((*fc
& 0xFFFF) != *fc
) {
190 PrintAndLog("Facility-Code Truncated to 16-bits (AWID50): %u", *fc
);
194 if ((*fc
& 0x1FFF) != *fc
) {
196 PrintAndLog("Facility-Code Truncated to 13-bits (AWID37): %u", *fc
);
198 if ((*cn
& 0x3FFFF) != *cn
) {
200 PrintAndLog("Card Number Truncated to 18-bits (AWID37): %u", *cn
);
204 if ((*fc
& 0xFF) != *fc
) {
206 PrintAndLog("Facility-Code Truncated to 8-bits (AWID34): %u", *fc
);
208 if ((*cn
& 0xFFFFFF) != *cn
) {
210 PrintAndLog("Card Number Truncated to 24-bits (AWID34): %u", *cn
);
216 if ((*fc
& 0xFF) != *fc
) {
218 PrintAndLog("Facility-Code Truncated to 8-bits (AWID26): %u", *fc
);
220 if ((*cn
& 0xFFFF) != *cn
) {
222 PrintAndLog("Card Number Truncated to 16-bits (AWID26): %u", *cn
);
228 int CmdAWIDSim(const char *Cmd
) {
229 uint32_t fc
= 0, cn
= 0;
233 size_t size
= sizeof(bits
);
234 memset(bs
, 0x00, size
);
236 uint64_t arg1
= ( 10 << 8 ) + 8; // fcHigh = 10, fcLow = 8
237 uint64_t arg2
= 50; // clk RF/50 invert=0
239 char cmdp
= param_getchar(Cmd
, 0);
240 if (strlen(Cmd
) == 0 || cmdp
== 'h' || cmdp
== 'H') return usage_lf_awid_sim();
242 fmtlen
= param_get8(Cmd
, 0);
243 fc
= param_get32ex(Cmd
, 1, 0, 10);
244 cn
= param_get32ex(Cmd
, 2, 0, 10);
245 if ( !fc
|| !cn
) return usage_lf_awid_sim();
247 verify_values(&fmtlen
, &fc
, &cn
);
249 PrintAndLog("Emulating AWID %u -- FC: %u; CN: %u\n", fmtlen
, fc
, cn
);
250 PrintAndLog("Press pm3-button to abort simulation or run another command");
252 if (!getAWIDBits(fmtlen
, fc
, cn
, bs
)) {
253 PrintAndLog("Error with tag bitstream generation.");
256 // AWID uses: fcHigh: 10, fcLow: 8, clk: 50, invert: 0
257 // arg1 --- fcHigh<<8 + fcLow
258 // arg2 --- Inversion and clk setting
259 // 96 --- Bitstream length: 96-bits == 12 bytes
260 UsbCommand c
= {CMD_FSK_SIM_TAG
, {arg1
, arg2
, size
}};
261 memcpy(c
.d
.asBytes
, bs
, size
);
262 clearCommandBuffer();
267 int CmdAWIDClone(const char *Cmd
) {
268 uint32_t blocks
[4] = {T55x7_MODULATION_FSK2a
| T55x7_BITRATE_RF_50
| 3<<T55x7_MAXBLOCK_SHIFT
, 0, 0, 0};
269 uint32_t fc
= 0, cn
= 0;
273 memset(bs
,0,sizeof(bits
));
275 char cmdp
= param_getchar(Cmd
, 0);
276 if (strlen(Cmd
) == 0 || cmdp
== 'h' || cmdp
== 'H') return usage_lf_awid_clone();
278 fmtlen
= param_get8(Cmd
, 0);
279 fc
= param_get32ex(Cmd
, 1, 0, 10);
280 cn
= param_get32ex(Cmd
, 2, 0, 10);
282 if ( !fc
|| !cn
) return usage_lf_awid_clone();
284 if (param_getchar(Cmd
, 3) == 'Q' || param_getchar(Cmd
, 3) == 'q')
285 //t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
286 blocks
[0] = T5555_MODULATION_FSK2
| T5555_INVERT_OUTPUT
| ((50-2)>>1) << T5555_BITRATE_SHIFT
| 3<<T5555_MAXBLOCK_SHIFT
;
288 verify_values(&fmtlen
, &fc
, &cn
);
290 if ( !getAWIDBits(fmtlen
, fc
, cn
, bs
)) {
291 PrintAndLog("Error with tag bitstream generation.");
295 blocks
[1] = bytebits_to_byte(bs
,32);
296 blocks
[2] = bytebits_to_byte(bs
+32,32);
297 blocks
[3] = bytebits_to_byte(bs
+64,32);
299 PrintAndLog("Preparing to clone AWID %u to T55x7 with FC: %u, CN: %u", fmtlen
, fc
, cn
);
300 PrintAndLog("Blk | Data ");
301 PrintAndLog("----+------------");
302 PrintAndLog(" 00 | 0x%08x", blocks
[0]);
303 PrintAndLog(" 01 | 0x%08x", blocks
[1]);
304 PrintAndLog(" 02 | 0x%08x", blocks
[2]);
305 PrintAndLog(" 03 | 0x%08x", blocks
[3]);
308 UsbCommand c
= {CMD_T55XX_WRITE_BLOCK
, {0,0,0}};
310 for (uint8_t i
=0; i
<4; i
++) {
311 c
.arg
[0] = blocks
[i
];
313 clearCommandBuffer();
315 if (!WaitForResponseTimeout(CMD_ACK
, &resp
, T55XX_WRITE_TIMEOUT
)){
316 PrintAndLog("Error occurred, device did not respond during write operation.");
323 int CmdAWIDBrute(const char *Cmd
){
326 uint32_t fc
= 0, cn
= 0, delay
= 1000;
330 size_t size
= sizeof(bits
);
331 memset(bs
, 0x00, size
);
334 while(param_getchar(Cmd
, cmdp
) != 0x00 && !errors
) {
335 switch(param_getchar(Cmd
, cmdp
)) {
338 return usage_lf_awid_brute();
341 fc
= param_get32ex(Cmd
,cmdp
+1, 0, 10);
348 // delay between attemps, defaults to 1000ms.
349 delay
= param_get32ex(Cmd
, cmdp
+1, 1000, 10);
354 cn
= param_get32ex(Cmd
, cmdp
+1, 0, 10);
355 // truncate cardnumber.
361 fmtlen
= param_get8(Cmd
, cmdp
+1);
365 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
370 if ( fc
== 0 )errors
= true;
371 if ( errors
) return usage_lf_awid_brute();
373 // limit fc according to selected format
376 if ((fc
& 0xFFFF) != fc
) {
378 PrintAndLog("Facility-code truncated to 16-bits (AWID50): %u", fc
);
382 if ((fc
& 0xFF) != fc
) {
384 PrintAndLog("Facility-code truncated to 8-bits (AWID26): %u", fc
);
389 PrintAndLog("Bruteforceing AWID %d Reader", fmtlen
);
390 PrintAndLog("Press pm3-button to abort simulation or press key");
398 printf("Device offline\n");
402 PrintAndLog("aborted via keyboard!");
408 if ( !sendTry(fmtlen
, fc
, up
++, delay
, bs
, size
)) return 1;
410 // Do one down (if cardnumber is given)
413 if ( !sendTry(fmtlen
, fc
, --down
, delay
, bs
, size
)) return 1;
418 static command_t CommandTable
[] = {
419 {"help", CmdHelp
, 1, "This help"},
420 {"fskdemod", CmdAWIDDemodFSK
, 0, "Realtime AWID FSK demodulator"},
421 {"read", CmdAWIDRead
, 0, "Attempt to read and extract tag data"},
422 {"sim", CmdAWIDSim
, 0, "AWID tag simulator"},
423 {"clone", CmdAWIDClone
, 0, "Clone AWID to T55x7"},
424 {"brute", CmdAWIDBrute
, 0, "Bruteforce card number against reader"},
425 {NULL
, NULL
, 0, NULL
}
428 int CmdLFAWID(const char *Cmd
) {
429 clearCommandBuffer();
430 CmdsParse(CommandTable
, Cmd
);
434 int CmdHelp(const char *Cmd
) {
435 CmdsHelp(CommandTable
);