1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // High frequency Legic commands
9 //-----------------------------------------------------------------------------
10 #include "cmdhflegic.h"
12 static int CmdHelp(const char *Cmd
);
14 #define MAX_LENGTH 1024
16 int usage_legic_calccrc(void){
17 PrintAndLog("Calculates the legic crc8/crc16 on the given data.");
18 PrintAndLog("There must be an even number of hexsymbols as input.");
19 PrintAndLog("Usage: hf legic crc [h] d <data> u <uidcrc> c <8|16>");
20 PrintAndLog("Options:");
21 PrintAndLog(" h : this help");
22 PrintAndLog(" d <data> : (hex symbols) bytes to calculate crc over");
23 PrintAndLog(" u <uidcrc> : MCC hexbyte");
24 PrintAndLog(" c <8|16> : Crc type");
26 PrintAndLog("Samples:");
27 PrintAndLog(" hf legic crc b deadbeef1122");
28 PrintAndLog(" hf legic crc b deadbeef1122 u 9A c 16");
31 int usage_legic_rdmem(void){
32 PrintAndLog("Read data from a legic tag.");
33 PrintAndLog("Usage: hf legic rdmem [h] <offset> <length> <IV>");
34 PrintAndLog("Options:");
35 PrintAndLog(" h : this help");
36 PrintAndLog(" <offset> : (hex) offset in data array to start download from");
37 PrintAndLog(" <length> : (hex) number of bytes to read");
38 PrintAndLog(" <IV> : (hex) (optional) Initialization vector to use. Must be odd and 7bits max");
40 PrintAndLog("Samples:");
41 PrintAndLog(" hf legic rdmem 0 16 - reads from byte[0] 0x16 bytes(system header)");
42 PrintAndLog(" hf legic rdmem 0 4 55 - reads from byte[0] 0x4 bytes with IV 0x55");
43 PrintAndLog(" hf legic rdmem 0 100 55 - reads 0x100 bytes with IV 0x55");
46 int usage_legic_sim(void){
47 PrintAndLog("Simulates a LEGIC Prime tag. MIM22, MIM256, MIM1024 types can be emulated");
48 PrintAndLog("Use eload/esave to upload a dump into emulator memory");
49 PrintAndLog("Usage: hf legic sim [h] <tagtype> <phase> <frame> <reqresp>");
50 PrintAndLog("Options:");
51 PrintAndLog(" h : this help");
52 PrintAndLog(" <tagtype> : 0 = MIM22");
53 PrintAndLog(" : 1 = MIM256 (default)");
54 PrintAndLog(" : 2 = MIM1024");
55 PrintAndLog(" <phase> : phase drift");
56 PrintAndLog(" <frame> : frame drift");
57 PrintAndLog(" <reqresp> : reqresp drift");
59 PrintAndLog("Samples:");
60 PrintAndLog(" hf legic sim");
61 PrintAndLog(" hf legic sim ");
64 int usage_legic_write(void){
65 PrintAndLog("Write data to a LEGIC Prime tag. It autodetects tagsize to make sure size");
66 PrintAndLog("Usage: hf legic write [h] o <offset> d <data (hex symbols)>");
67 PrintAndLog("Options:");
68 PrintAndLog(" h : this help");
69 PrintAndLog(" o <offset> : (hex) offset in data array to start writing");
70 //PrintAndLog(" <IV> : (optional) Initialization vector to use (ODD and 7bits)");
71 PrintAndLog(" d <data> : (hex symbols) bytes to write ");
73 PrintAndLog("Samples:");
74 PrintAndLog(" hf legic write o 10 d 11223344 - Write 0x11223344 starting from offset 0x10");
77 int usage_legic_reader(void){
78 PrintAndLog("Read UID and type information from a legic tag.");
79 PrintAndLog("Usage: hf legic reader [h]");
80 PrintAndLog("Options:");
81 PrintAndLog(" h : this help");
83 PrintAndLog("Samples:");
84 PrintAndLog(" hf legic reader");
87 int usage_legic_info(void){
88 PrintAndLog("Reads information from a legic prime tag.");
89 PrintAndLog("Shows systemarea, user areas etc");
90 PrintAndLog("Usage: hf legic info [h]");
91 PrintAndLog("Options:");
92 PrintAndLog(" h : this help");
94 PrintAndLog("Samples:");
95 PrintAndLog(" hf legic info");
98 int usage_legic_dump(void){
99 PrintAndLog("Reads all pages from LEGIC Prime MIM22, MIM256, MIM1024");
100 PrintAndLog("and saves binary dump into the file `filename.bin` or `cardUID.bin`");
101 PrintAndLog("It autodetects card type.\n");
102 PrintAndLog("Usage: hf legic dump [h] o <filename w/o .bin>");
103 PrintAndLog("Options:");
104 PrintAndLog(" h : this help");
105 PrintAndLog(" o <filename> : filename w/o '.bin' to dump bytes");
107 PrintAndLog("Samples:");
108 PrintAndLog(" hf legic dump");
109 PrintAndLog(" hf legic dump o myfile");
112 int usage_legic_restore(void){
113 PrintAndLog("Reads binary file and it autodetects card type and verifies that the file has the same size");
114 PrintAndLog("Then write the data back to card. All bytes except the first 7bytes [UID(4) MCC(1) DCF(2)]\n");
115 PrintAndLog("Usage: hf legic restore [h] i <filename w/o .bin>");
116 PrintAndLog("Options:");
117 PrintAndLog(" h : this help");
118 PrintAndLog(" i <filename> : filename w/o '.bin' to restore bytes on to card from");
120 PrintAndLog("Samples:");
121 PrintAndLog(" hf legic restore i myfile");
124 int usage_legic_eload(void){
125 PrintAndLog("It loads binary dump from the file `filename.bin`");
126 PrintAndLog("Usage: hf legic eload [h] [card memory] <file name w/o `.bin`>");
127 PrintAndLog("Options:");
128 PrintAndLog(" h : this help");
129 PrintAndLog(" [card memory] : 0 = MIM22");
130 PrintAndLog(" : 1 = MIM256 (default)");
131 PrintAndLog(" : 2 = MIM1024");
132 PrintAndLog(" <filename> : filename w/o .bin to load");
134 PrintAndLog("Samples:");
135 PrintAndLog(" hf legic eload 2 myfile");
138 int usage_legic_esave(void){
139 PrintAndLog("It saves binary dump into the file `filename.bin` or `cardID.bin`");
140 PrintAndLog(" Usage: hf legic esave [h] [card memory] [file name w/o `.bin`]");
141 PrintAndLog("Options:");
142 PrintAndLog(" h : this help");
143 PrintAndLog(" [card memory] : 0 = MIM22");
144 PrintAndLog(" : 1 = MIM256 (default)");
145 PrintAndLog(" : 2 = MIM1024");
146 PrintAndLog(" <filename> : filename w/o .bin to load");
148 PrintAndLog("Samples:");
149 PrintAndLog(" hf legic esave 2 myfile");
154 * Output BigBuf and deobfuscate LEGIC RF tag data.
155 * This is based on information given in the talk held
156 * by Henryk Ploetz and Karsten Nohl at 26c3
158 int CmdLegicInfo(const char *Cmd
) {
160 char cmdp
= param_getchar(Cmd
, 0);
161 if ( cmdp
== 'H' || cmdp
== 'h' ) return usage_legic_info();
163 int i
= 0, k
= 0, segmentNum
= 0, segment_len
= 0, segment_flag
= 0;
164 int crc
= 0, wrp
= 0, wrc
= 0;
165 uint8_t stamp_len
= 0;
166 uint8_t data
[1024]; // receiver buffer
167 char token_type
[5] = {0,0,0,0,0};
169 int bIsSegmented
= 0;
171 CmdLegicRdmem("0 22 55");
173 // copy data from device
174 GetEMLFromBigBuf(data
, sizeof(data
), 0);
175 if ( !WaitForResponseTimeout(CMD_ACK
, NULL
, 2000)){
176 PrintAndLog("Command execute timeout");
180 // Output CDF System area (9 bytes) plus remaining header area (12 bytes)
182 uint32_t calc_crc
= CRC8Legic(data
, 4);
184 PrintAndLog("\nCDF: System Area");
185 PrintAndLog("------------------------------------------------------");
186 PrintAndLog("MCD: %02x, MSN: %02x %02x %02x, MCC: %02x %s",
192 (calc_crc
== crc
) ? "OK":"Fail"
195 // MCD = Manufacturer ID (should be list meaning something?)
198 dcf
= ((int)data
[6] << 8) | (int)data
[5];
200 // New unwritten media?
203 PrintAndLog("DCF: %d (%02x %02x), Token Type=NM (New Media)",
209 } else if (dcf
> 60000) { // Master token?
213 if(data
[6] == 0xec) {
214 strncpy(token_type
, "XAM", sizeof(token_type
));
216 stamp_len
= 0x0c - (data
[5] >> 4);
218 switch (data
[5] & 0x7f) {
220 strncpy(token_type
, "IAM", sizeof(token_type
));
221 fl
= (0x2f - (data
[5] & 0x7f)) + 1;
224 strncpy(token_type
, "SAM", sizeof(token_type
));
225 fl
= (0x6f - (data
[5] & 0x7f)) + 1;
228 strncpy(token_type
, "GAM", sizeof(token_type
));
229 fl
= (0x7f - (data
[5] & 0x7f)) + 1;
233 stamp_len
= 0xfc - data
[6];
236 PrintAndLog("DCF: %d (%02x %02x), Token Type=%s (OLE=%01u), OL=%02u, FL=%02u",
241 (data
[5] & 0x80 )>> 7,
246 } else { // Is IM(-S) type of card...
248 if(data
[7] == 0x9F && data
[8] == 0xFF) {
250 strncpy(token_type
, "IM-S", sizeof(token_type
));
252 strncpy(token_type
, "IM", sizeof(token_type
));
255 PrintAndLog("DCF: %d (%02x %02x), Token Type=%s (OLE=%01u)",
264 // Makes no sence to show this on blank media...
268 PrintAndLog("WRP=%02u, WRC=%01u, RD=%01u, SSC=%02x",
270 (data
[7] & 0x70) >> 4,
271 (data
[7] & 0x80) >> 7,
276 // Header area is only available on IM-S cards, on master tokens this data is the master token data itself
277 if(bIsSegmented
|| dcf
> 60000) {
279 PrintAndLog("Master token data");
280 PrintAndLog("%s", sprint_hex(data
+8, 14));
282 PrintAndLog("Remaining Header Area");
283 PrintAndLog("%s", sprint_hex(data
+9, 13));
288 uint8_t segCrcBytes
[8] = {0,0,0,0,0,0,0,0};
289 uint32_t segCalcCRC
= 0;
295 PrintAndLog("\nADF: User Area");
296 PrintAndLog("------------------------------------------------------");
300 // Data start point on segmented cards
304 for (segmentNum
=1; segmentNum
< 128; segmentNum
++ )
306 segment_len
= ((data
[i
+1] ^ crc
) & 0x0f) * 256 + (data
[i
] ^ crc
);
307 segment_flag
= ((data
[i
+1] ^ crc
) & 0xf0) >> 4;
308 wrp
= (data
[i
+2] ^ crc
);
309 wrc
= ((data
[i
+3] ^ crc
) & 0x70) >> 4;
311 bool hasWRC
= (wrc
> 0);
312 bool hasWRP
= (wrp
> wrc
);
313 int wrp_len
= (wrp
- wrc
);
314 int remain_seg_payload_len
= (segment_len
- wrp
- 5);
316 // validate segment-crc
317 segCrcBytes
[0]=data
[0]; //uid0
318 segCrcBytes
[1]=data
[1]; //uid1
319 segCrcBytes
[2]=data
[2]; //uid2
320 segCrcBytes
[3]=data
[3]; //uid3
321 segCrcBytes
[4]=(data
[i
] ^ crc
); //hdr0
322 segCrcBytes
[5]=(data
[i
+1] ^ crc
); //hdr1
323 segCrcBytes
[6]=(data
[i
+2] ^ crc
); //hdr2
324 segCrcBytes
[7]=(data
[i
+3] ^ crc
); //hdr3
326 segCalcCRC
= CRC8Legic(segCrcBytes
, 8);
327 segCRC
= data
[i
+4] ^ crc
;
329 PrintAndLog("Segment %02u \nraw header | 0x%02X 0x%02X 0x%02X 0x%02X \nSegment len: %u, Flag: 0x%X (valid:%01u, last:%01u), WRP: %02u, WRC: %02u, RD: %01u, CRC: 0x%02X (%s)",
337 (segment_flag
& 0x4) >> 2,
338 (segment_flag
& 0x8) >> 3,
341 ((data
[i
+3]^crc
) & 0x80) >> 7,
343 ( segCRC
== segCalcCRC
) ? "OK" : "fail"
349 PrintAndLog("WRC protected area: (I %d | K %d| WRC %d)", i
, k
, wrc
);
350 PrintAndLog("\nrow | data");
351 PrintAndLog("-----+------------------------------------------------");
353 for ( k
=i
; k
< (i
+ wrc
); ++k
)
356 print_hex_break( data
+i
, wrc
, 16);
362 PrintAndLog("Remaining write protected area: (I %d | K %d | WRC %d | WRP %d WRP_LEN %d)",i
, k
, wrc
, wrp
, wrp_len
);
363 PrintAndLog("\nrow | data");
364 PrintAndLog("-----+------------------------------------------------");
366 for (k
=i
; k
< (i
+wrp_len
); ++k
)
369 print_hex_break( data
+i
, wrp_len
, 16);
373 // does this one work? (Answer: Only if KGH/BGH is used with BCD encoded card number! So maybe this will show just garbage...)
375 PrintAndLog("Card ID: %2X%02X%02X", data
[i
-4]^crc
, data
[i
-3]^crc
, data
[i
-2]^crc
);
378 PrintAndLog("Remaining segment payload: (I %d | K %d | Remain LEN %d)", i
, k
, remain_seg_payload_len
);
379 PrintAndLog("\nrow | data");
380 PrintAndLog("-----+------------------------------------------------");
382 for ( k
=i
; k
< (i
+remain_seg_payload_len
); ++k
)
385 print_hex_break( data
+i
, remain_seg_payload_len
, 16);
387 i
+= remain_seg_payload_len
;
389 PrintAndLog("-----+------------------------------------------------\n");
391 // end with last segment
392 if (segment_flag
& 0x8) return 0;
398 // Data start point on unsegmented cards
401 wrp
= data
[7] & 0x0F;
402 wrc
= (data
[7] & 0x70) >> 4;
404 bool hasWRC
= (wrc
> 0);
405 bool hasWRP
= (wrp
> wrc
);
406 int wrp_len
= (wrp
- wrc
);
407 int remain_seg_payload_len
= (1024 - 22 - wrp
); // Any chance to get physical card size here!?
409 PrintAndLog("Unsegmented card - WRP: %02u, WRC: %02u, RD: %01u",
412 (data
[7] & 0x80) >> 7
416 PrintAndLog("WRC protected area: (I %d | WRC %d)", i
, wrc
);
417 PrintAndLog("\nrow | data");
418 PrintAndLog("-----+------------------------------------------------");
419 print_hex_break( data
+i
, wrc
, 16);
424 PrintAndLog("Remaining write protected area: (I %d | WRC %d | WRP %d | WRP_LEN %d)", i
, wrc
, wrp
, wrp_len
);
425 PrintAndLog("\nrow | data");
426 PrintAndLog("-----+------------------------------------------------");
427 print_hex_break( data
+ i
, wrp_len
, 16);
430 // does this one work? (Answer: Only if KGH/BGH is used with BCD encoded card number! So maybe this will show just garbage...)
432 PrintAndLog("Card ID: %2X%02X%02X", data
[i
-4], data
[i
-3], data
[i
-2]);
435 PrintAndLog("Remaining segment payload: (I %d | Remain LEN %d)", i
, remain_seg_payload_len
);
436 PrintAndLog("\nrow | data");
437 PrintAndLog("-----+------------------------------------------------");
438 print_hex_break( data
+ i
, remain_seg_payload_len
, 16);
439 i
+= remain_seg_payload_len
;
441 PrintAndLog("-----+------------------------------------------------\n");
448 // offset in data memory
449 // number of bytes to read
450 int CmdLegicRdmem(const char *Cmd
) {
452 char cmdp
= param_getchar(Cmd
, 0);
453 if ( cmdp
== 'H' || cmdp
== 'h' ) return usage_legic_rdmem();
455 uint32_t offset
= 0, len
= 0, IV
= 1;
456 sscanf(Cmd
, "%x %x %x", &offset
, &len
, &IV
);
459 legic_card_select_t card
;
460 if (legic_get_type(&card
)) {
461 PrintAndLog("Failed to identify tagtype");
465 legic_print_type(card
.cardsize
, 0);
467 // OUT-OF-BOUNDS check
468 // UID 4 bytes can't be written to.
469 if ( len
+ offset
>= card
.cardsize
) {
470 len
= card
.cardsize
- offset
;
471 PrintAndLog("Out-of-bounds, Cardsize = %d, Trunc offset+len = %d", card
.cardsize
, len
+ offset
);
476 UsbCommand c
= {CMD_READER_LEGIC_RF
, {offset
, len
, IV
}};
477 clearCommandBuffer();
480 if ( !WaitForResponseTimeout(CMD_ACK
, &resp
, 3000) ) {
481 PrintAndLog("command execution time out");
485 uint8_t isOK
= resp
.arg
[0] & 0xFF;
486 uint16_t readlen
= resp
.arg
[1];
488 PrintAndLog("failed reading tag");
492 uint8_t *data
= malloc(readlen
);
494 PrintAndLog("Cannot allocate memory");
498 if ( readlen
!= len
)
499 PrintAndLog("Fail, only managed to read 0x%02X bytes", readlen
);
501 // copy data from device
502 GetEMLFromBigBuf(data
, readlen
, 0);
503 if ( !WaitForResponseTimeout(CMD_ACK
, NULL
, 2500)){
504 PrintAndLog("Command execute timeout");
509 PrintAndLog("\n ## | Data");
510 PrintAndLog("-----+-----");
511 print_hex_break( data
, readlen
, 32);
516 // should say which tagtype
517 // should load a tag to device mem.
518 // int phase, int frame, int reqresp
519 int CmdLegicRfSim(const char *Cmd
) {
520 UsbCommand c
= {CMD_SIMULATE_TAG_LEGIC_RF
, {6,3,0}};
521 sscanf(Cmd
, " %"lli
" %"lli
" %"lli
, &c
.arg
[0], &c
.arg
[1], &c
.arg
[2]);
522 clearCommandBuffer();
527 int CmdLegicRfWrite(const char *Cmd
) {
529 uint8_t *data
= NULL
;
533 uint32_t offset
= 0, IV
= 0x55;
535 while(param_getchar(Cmd
, cmdp
) != 0x00) {
536 switch(param_getchar(Cmd
, cmdp
)) {
539 // peek at length of the input string so we can
540 // figure out how many elements to malloc in "data"
542 if (param_getptr(Cmd
, &bg
, &en
, cmdp
+1)) {
548 // check that user entered even number of characters
549 // for hex data string
555 // it's possible for user to accidentally enter "b" parameter
556 // more than once - we have to clean previous malloc
559 data
= malloc(len
>> 1);
560 if ( data
== NULL
) {
561 PrintAndLog("Can't allocate memory. exiting");
566 if (param_gethex(Cmd
, cmdp
+1, data
, len
)) {
576 offset
= param_get32ex(Cmd
, cmdp
+1, 4, 16);
584 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
594 return usage_legic_write();
598 legic_card_select_t card
;
599 if (legic_get_type(&card
)) {
600 PrintAndLog("Failed to identify tagtype");
604 legic_print_type(card
.cardsize
, 0);
606 // OUT-OF-BOUNDS checks
607 // UID 4 bytes can't be written to.
609 PrintAndLog("Out-of-bounds, UID 4bytes can't be written to. Offset = %d", offset
);
613 if ( len
+ offset
+ 4 >= card
.cardsize
) {
614 PrintAndLog("Out-of-bounds, Cardsize = %d, [offset+len = %d ]", card
.cardsize
, len
+ offset
+ 4);
620 PrintAndLog("Writing to tag");
621 UsbCommand c
= {CMD_WRITER_LEGIC_RF
, {offset
, len
, IV
}};
622 memcpy(c
.d
.asBytes
, data
, len
);
624 clearCommandBuffer();
627 if (!WaitForResponseTimeout(CMD_ACK
, &resp
, 4000)) {
628 PrintAndLog("command execution time out");
631 uint8_t isOK
= resp
.arg
[0] & 0xFF;
633 PrintAndLog("failed writing tag");
641 PrintAndLog("############# DANGER !! #############");
642 PrintAndLog("# changing the DCF is irreversible #");
643 PrintAndLog("#####################################");
644 PrintAndLog("do youe really want to continue? y(es) n(o)");
645 // if (scanf(" %c", &answer) > 0 && (answer == 'y' || answer == 'Y')) {
650 int CmdLegicCalcCrc(const char *Cmd
){
652 uint8_t *data
= NULL
;
653 uint8_t cmdp
= 0, uidcrc
= 0, type
=0;
658 while(param_getchar(Cmd
, cmdp
) != 0x00) {
659 switch(param_getchar(Cmd
, cmdp
)) {
662 // peek at length of the input string so we can
663 // figure out how many elements to malloc in "data"
665 if (param_getptr(Cmd
, &bg
, &en
, cmdp
+1)) {
671 // check that user entered even number of characters
672 // for hex data string
678 // it's possible for user to accidentally enter "b" parameter
679 // more than once - we have to clean previous malloc
680 if (data
) free(data
);
681 data
= malloc(len
>> 1);
682 if ( data
== NULL
) {
683 PrintAndLog("Can't allocate memory. exiting");
688 if (param_gethex(Cmd
, cmdp
+1, data
, len
)) {
698 uidcrc
= param_get8ex(Cmd
, cmdp
+1, 0, 16);
703 type
= param_get8ex(Cmd
, cmdp
+1, 0, 10);
711 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
719 if (data
) free(data
);
720 return usage_legic_calccrc();
725 PrintAndLog("Legic crc16: %X", CRC16Legic(data
, len
, uidcrc
));
728 PrintAndLog("Legic crc8: %X", CRC8Legic(data
, len
) );
732 if (data
) free(data
);
736 int legic_print_type(uint32_t tagtype
, uint8_t spaces
){
739 char *spacer
= spc
+ (10-spaces
);
742 PrintAndLog("%sTYPE : MIM%d card (outdated)", spacer
, tagtype
);
743 else if ( tagtype
== 256 )
744 PrintAndLog("%sTYPE : MIM%d card (234 bytes)", spacer
, tagtype
);
745 else if ( tagtype
== 1024 )
746 PrintAndLog("%sTYPE : MIM%d card (1002 bytes)", spacer
, tagtype
);
748 PrintAndLog("%sTYPE : Unknown %06x", spacer
, tagtype
);
751 int legic_get_type(legic_card_select_t
*card
){
753 if ( card
== NULL
) return 1;
755 UsbCommand c
= {CMD_LEGIC_INFO
, {0,0,0}};
756 clearCommandBuffer();
759 if (!WaitForResponseTimeout(CMD_ACK
, &resp
, 500))
762 uint8_t isOK
= resp
.arg
[0] & 0xFF;
766 memcpy(card
, (legic_card_select_t
*)resp
.d
.asBytes
, sizeof(legic_card_select_t
));
769 void legic_chk_iv(uint32_t *iv
){
770 if ( (*iv
& 0x7F) != *iv
){
772 PrintAndLog("Truncating IV to 7bits, %u", *iv
);
775 if ( (*iv
& 1) == 0 ){
777 PrintAndLog("LSB of IV must be SET %u", *iv
);
780 void legic_seteml(uint8_t *src
, uint32_t offset
, uint32_t numofbytes
) {
782 UsbCommand c
= {CMD_LEGIC_ESET
, {0, 0, 0}};
783 for(size_t i
= 0; i
< numofbytes
; i
+= USB_CMD_DATA_SIZE
) {
785 len
= MIN((numofbytes
- i
), USB_CMD_DATA_SIZE
);
786 c
.arg
[0] = i
; // offset
787 c
.arg
[1] = len
; // number of bytes
788 memcpy(c
.d
.asBytes
, src
+i
, len
);
789 clearCommandBuffer();
794 int HFLegicReader(const char *Cmd
, bool verbose
) {
796 char cmdp
= param_getchar(Cmd
, 0);
797 if ( cmdp
== 'H' || cmdp
== 'h' ) return usage_legic_reader();
799 legic_card_select_t card
;
800 switch(legic_get_type(&card
)){
802 if ( verbose
) PrintAndLog("command execution time out");
806 if ( verbose
) PrintAndLog("legic card select failed");
810 PrintAndLog(" UID : %s", sprint_hex(card
.uid
, sizeof(card
.uid
)));
811 legic_print_type(card
.cardsize
, 0);
814 int CmdLegicReader(const char *Cmd
){
815 return HFLegicReader(Cmd
, TRUE
);
818 int CmdLegicDump(const char *Cmd
){
821 char filename
[FILE_PATH_SIZE
] = {0x00};
822 char *fnameptr
= filename
;
828 memset(filename
, 0, sizeof(filename
));
830 while(param_getchar(Cmd
, cmdp
) != 0x00) {
831 switch(param_getchar(Cmd
, cmdp
)) {
834 return usage_legic_dump();
837 fileNlen
= param_getstr(Cmd
, cmdp
+1, filename
);
840 if (fileNlen
> FILE_PATH_SIZE
-5)
841 fileNlen
= FILE_PATH_SIZE
-5;
845 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
853 if(errors
) return usage_legic_dump();
856 legic_card_select_t card
;
857 if (legic_get_type(&card
)) {
858 PrintAndLog("Failed to identify tagtype");
861 dumplen
= card
.cardsize
;
863 legic_print_type(dumplen
, 0);
864 PrintAndLog("Reading tag memory...");
866 UsbCommand c
= {CMD_READER_LEGIC_RF
, {0x00, dumplen
, 0x55}};
867 clearCommandBuffer();
870 if (!WaitForResponseTimeout(CMD_ACK
, &resp
, 3000)) {
871 PrintAndLog("Command execute time-out");
875 uint8_t isOK
= resp
.arg
[0] & 0xFF;
877 PrintAndLog("Failed dumping tag data");
881 uint16_t readlen
= resp
.arg
[1];
882 uint8_t *data
= malloc(readlen
);
884 PrintAndLog("Fail, cannot allocate memory");
887 memset(data
, 0, readlen
);
889 if ( readlen
!= dumplen
)
890 PrintAndLog("Fail, only managed to read 0x%02X bytes of 0x%02X", readlen
, dumplen
);
892 // copy data from device
893 GetEMLFromBigBuf(data
, readlen
, 0);
894 if ( !WaitForResponseTimeout(CMD_ACK
, NULL
, 2500)) {
895 PrintAndLog("Fail, transfer from device time-out");
900 // user supplied filename?
902 sprintf(fnameptr
,"%02X%02X%02X%02X.bin", data
[0], data
[1], data
[2], data
[3]);
904 sprintf(fnameptr
+ fileNlen
,".bin");
906 if ((f
= fopen(filename
,"wb")) == NULL
) {
907 PrintAndLog("Could not create file name %s", filename
);
912 fwrite(data
, 1, readlen
, f
);
915 PrintAndLog("Wrote %d bytes to %s", readlen
, filename
);
919 int CmdLegicRestore(const char *Cmd
){
922 char filename
[FILE_PATH_SIZE
] = {0x00};
923 char *fnameptr
= filename
;
929 memset(filename
, 0, sizeof(filename
));
931 while(param_getchar(Cmd
, cmdp
) != 0x00) {
932 switch(param_getchar(Cmd
, cmdp
)) {
939 fileNlen
= param_getstr(Cmd
, cmdp
+1, filename
);
942 if (fileNlen
> FILE_PATH_SIZE
-5)
943 fileNlen
= FILE_PATH_SIZE
-5;
947 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
955 if(errors
) return usage_legic_restore();
958 legic_card_select_t card
;
959 if (legic_get_type(&card
)) {
960 PrintAndLog("Failed to identify tagtype");
963 numofbytes
= card
.cardsize
;
966 uint8_t *data
= malloc(numofbytes
);
968 PrintAndLog("Fail, cannot allocate memory");
971 memset(data
, 0, numofbytes
);
973 legic_print_type(numofbytes
, 0);
976 fnameptr
+= fileNlen
;
977 sprintf(fnameptr
, ".bin");
979 if ((f
= fopen(filename
,"rb")) == NULL
) {
980 PrintAndLog("File %s not found or locked", filename
);
984 // verify size of dumpfile is the same as card.
985 fseek(f
, 0, SEEK_END
); // seek to end of file
986 size_t filesize
= ftell(f
); // get current file pointer
987 fseek(f
, 0, SEEK_SET
); // seek back to beginning of file
989 if ( filesize
!= numofbytes
) {
990 PrintAndLog("Fail, Filesize and cardsize is not equal. [%u != %u]", filesize
, numofbytes
);
997 PrintAndLog("Reading binary file...");
1001 size_t bytes_read
= fread(data
, 1, numofbytes
, f
);
1002 if ( bytes_read
== 0){
1003 PrintAndLog("File reading error");
1010 PrintAndLog("Restoring %s to card", filename
);
1017 PrintAndLog("\nLoaded %d bytes from file: %s to emulator memory", numofbytes
, filename
);
1021 int CmdLegicELoad(const char *Cmd
) {
1023 char filename
[FILE_PATH_SIZE
];
1024 char *fnameptr
= filename
;
1025 int len
, numofbytes
;
1026 int nameParamNo
= 1;
1028 char cmdp
= param_getchar(Cmd
, 0);
1029 if ( cmdp
== 'h' || cmdp
== 'H' || cmdp
== 0x00)
1030 return usage_legic_eload();
1033 case '0' : numofbytes
= 22; break;
1035 case '\0': numofbytes
= 256; break;
1036 case '2' : numofbytes
= 1024; break;
1037 default : numofbytes
= 256; nameParamNo
= 0;break;
1041 uint8_t *data
= malloc(numofbytes
);
1043 PrintAndLog("Fail, cannot allocate memory");
1046 memset(data
, 0, numofbytes
);
1049 len
= param_getstr(Cmd
, nameParamNo
, filename
);
1050 if (len
> FILE_PATH_SIZE
- 5)
1051 len
= FILE_PATH_SIZE
- 5;
1053 sprintf(fnameptr
, ".bin");
1056 if ((f
= fopen(filename
,"rb")) == NULL
) {
1057 PrintAndLog("File %s not found or locked", filename
);
1063 size_t bytes_read
= fread(data
, 1, numofbytes
, f
);
1064 if ( bytes_read
== 0){
1065 PrintAndLog("File reading error");
1072 // transfer to device
1073 legic_seteml(data
, 0, numofbytes
);
1076 PrintAndLog("\nLoaded %d bytes from file: %s to emulator memory", numofbytes
, filename
);
1080 int CmdLegicESave(const char *Cmd
) {
1082 char filename
[FILE_PATH_SIZE
];
1083 char *fnameptr
= filename
;
1084 int fileNlen
, numofbytes
, nameParamNo
= 1;
1086 memset(filename
, 0, sizeof(filename
));
1088 char cmdp
= param_getchar(Cmd
, 0);
1090 if ( cmdp
== 'h' || cmdp
== 'H' || cmdp
== 0x00)
1091 return usage_legic_esave();
1094 case '0' : numofbytes
= 22; break;
1096 case '\0': numofbytes
= 256; break;
1097 case '2' : numofbytes
= 1024; break;
1098 default : numofbytes
= 256; nameParamNo
= 0; break;
1101 fileNlen
= param_getstr(Cmd
, nameParamNo
, filename
);
1103 if (fileNlen
> FILE_PATH_SIZE
- 5)
1104 fileNlen
= FILE_PATH_SIZE
- 5;
1107 uint8_t *data
= malloc(numofbytes
);
1109 PrintAndLog("Fail, cannot allocate memory");
1112 memset(data
, 0, numofbytes
);
1114 // download emulator memory
1115 PrintAndLog("Reading emulator memory...");
1116 GetEMLFromBigBuf(data
, numofbytes
, 0);
1117 if ( !WaitForResponseTimeout(CMD_ACK
, NULL
, 2500)) {
1118 PrintAndLog("Fail, transfer from device time-out");
1123 // user supplied filename?
1125 sprintf(fnameptr
,"%02X%02X%02X%02X.bin", data
[0], data
[1], data
[2], data
[3]);
1127 sprintf(fnameptr
+ fileNlen
,".bin");
1130 if ((f
= fopen(filename
,"wb")) == NULL
) {
1131 PrintAndLog("Could not create file name %s", filename
);
1135 fwrite(data
, 1, numofbytes
, f
);
1138 PrintAndLog("\nSaved %d bytes from emulator memory to file: %s", numofbytes
, filename
);
1142 int CmdLegicList(const char *Cmd
) {
1147 static command_t CommandTable
[] = {
1148 {"help", CmdHelp
, 1, "This help"},
1149 {"reader", CmdLegicReader
, 1, "LEGIC Prime Reader UID and tag info"},
1150 {"info", CmdLegicInfo
, 0, "Display deobfuscated and decoded LEGIC Prime tag data"},
1151 {"dump", CmdLegicDump
, 0, "Dump LEGIC Prime tag to binary file"},
1152 {"restore", CmdLegicRestore
, 0, "Restore a dump onto a LEGIC Prime tag"},
1153 {"rdmem", CmdLegicRdmem
, 0, "Read bytes from a LEGIC Prime tag"},
1154 {"sim", CmdLegicRfSim
, 0, "Start tag simulator"},
1155 {"write", CmdLegicRfWrite
, 0, "Write data to a LEGIC Prime tag"},
1156 {"crc", CmdLegicCalcCrc
, 1, "Calculate Legic CRC over given bytes"},
1157 {"eload", CmdLegicELoad
, 1, "Load binary dump to emulator memory"},
1158 {"esave", CmdLegicESave
, 1, "Save emulator memory to binary file"},
1159 {"list", CmdLegicList
, 1, "[Deprecated] List LEGIC history"},
1160 {NULL
, NULL
, 0, NULL
}
1163 int CmdHFLegic(const char *Cmd
) {
1164 clearCommandBuffer();
1165 CmdsParse(CommandTable
, Cmd
);
1169 int CmdHelp(const char *Cmd
) {
1170 CmdsHelp(CommandTable
);