]> cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhflegic.c
projects / proxmark3-svn / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
ADD: "hf legic eload" - Load binary file to emulator memory. Use "h" for help text
[proxmark3-svn] / client / cmdhflegic.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // High frequency Legic commands
9 //-----------------------------------------------------------------------------
10 #include "cmdhflegic.h"
11
12 static int CmdHelp(const char *Cmd);
13
14 #define MAX_LENGTH 1024
15
16 int usage_legic_calccrc8(void){
17 PrintAndLog("Calculates the legic crc8/crc16 on the input hexbytes.");
18 PrintAndLog("There must be an even number of hexsymbols as input.");
19 PrintAndLog("Usage: hf legic crc8 [h] b <hexbytes> u <uidcrc> c <crc type>");
20 PrintAndLog("Options:");
21 PrintAndLog(" h : this help");
22 PrintAndLog(" b <hexbytes> : hex bytes");
23 PrintAndLog(" u <uidcrc> : MCC hexbyte");
24 PrintAndLog(" c <crc type> : 8|16 bit crc size");
25 PrintAndLog("");
26 PrintAndLog("Samples:");
27 PrintAndLog(" hf legic crc8 b deadbeef1122");
28 PrintAndLog(" hf legic crc8 b deadbeef1122 u 9A c 16");
29 return 0;
30 }
31 int usage_legic_load(void){
32 PrintAndLog("It loads datasamples from the file `filename` to device memory");
33 PrintAndLog("Usage: hf legic load [h] <file name>");
34 PrintAndLog("Options:");
35 PrintAndLog(" h : this help");
36 PrintAndLog(" <filename> : Name of file to load");
37 PrintAndLog("");
38 PrintAndLog("Samples:");
39 PrintAndLog(" hf legic load filename");
40 return 0;
41 }
42 int usage_legic_rdmem(void){
43 PrintAndLog("Read data from a legic tag.");
44 PrintAndLog("Usage: hf legic rdmem [h] <offset> <length> <IV>");
45 PrintAndLog("Options:");
46 PrintAndLog(" h : this help");
47 PrintAndLog(" <offset> : offset in data array to start download from (hex)");
48 PrintAndLog(" <length> : number of bytes to read (hex)");
49 PrintAndLog(" <IV> : (optional) Initialization vector to use (hex, odd and 7bits)");
50 PrintAndLog("");
51 PrintAndLog("Samples:");
52 PrintAndLog(" hf legic rdmem 0 21 - reads from byte[0] 21 bytes(system header)");
53 PrintAndLog(" hf legic rdmem 0 4 55 - reads from byte[0] 4 bytes with IV 0x55");
54 PrintAndLog(" hf legic rdmem 0 100 55 - reads 256bytes with IV 0x55");
55 return 0;
56 }
57 int usage_legic_sim(void){
58 PrintAndLog("Missing help text.");
59 return 0;
60 }
61 int usage_legic_write(void){
62 PrintAndLog(" Write sample buffer to a legic tag. (use after load or read)");
63 PrintAndLog("Usage: hf legic write [h] <offset> <length> <IV>");
64 PrintAndLog("Options:");
65 PrintAndLog(" h : this help");
66 PrintAndLog(" <offset> : offset in data array to start writing from (hex)");
67 PrintAndLog(" <length> : number of bytes to write (hex)");
68 PrintAndLog(" <IV> : (optional) Initialization vector to use (ODD and 7bits)");
69 PrintAndLog("");
70 PrintAndLog("Samples:");
71 PrintAndLog(" hf legic write 10 4 - writes 0x4 to byte[0x10]");
72 return 0;
73 }
74 int usage_legic_rawwrite(void){
75 PrintAndLog("Write raw data direct to a specific offset on legic tag.");
76 PrintAndLog("Usage: hf legic writeraw [h] <offset> <value> <IV>");
77 PrintAndLog("Options:");
78 PrintAndLog(" h : this help");
79 PrintAndLog(" <offset> : offset to write to (hex)");
80 PrintAndLog(" <value> : value (hex)");
81 PrintAndLog(" <IV> : (optional) Initialization vector to use (hex, odd and 7bits)");
82 PrintAndLog("");
83 PrintAndLog("Samples:");
84 PrintAndLog(" hf legic writeraw 10 4 - writes 0x4 to byte[0x10]");
85 return 0;
86 }
87 int usage_legic_reader(void){
88 PrintAndLog("Read UID and type information from a legic tag.");
89 PrintAndLog("Usage: hf legic reader [h]");
90 PrintAndLog("Options:");
91 PrintAndLog(" h : this help");
92 PrintAndLog("");
93 PrintAndLog("Samples:");
94 PrintAndLog(" hf legic reader");
95 return 0;
96 }
97 int usage_legic_info(void){
98 PrintAndLog("Reads information from a legic prime tag.");
99 PrintAndLog("Shows systemarea, user areas etc");
100 PrintAndLog("Usage: hf legic info [h]");
101 PrintAndLog("Options:");
102 PrintAndLog(" h : this help");
103 PrintAndLog("");
104 PrintAndLog("Samples:");
105 PrintAndLog(" hf legic info");
106 return 0;
107 }
108 int usage_legic_dump(void){
109 PrintAndLog("Reads all pages from LEGIC MIM22, MIM256, MIM1024");
110 PrintAndLog("and saves binary dump into the file `filename.bin` or `cardUID.bin`");
111 PrintAndLog("It autodetects card type.\n");
112 PrintAndLog("Usage: hf legic dump [h] o <filename w/o .bin>");
113 PrintAndLog("Options:");
114 PrintAndLog(" h : this help");
115 PrintAndLog(" n <FN> : filename w/o .bin to save the dump as");
116 PrintAndLog("");
117 PrintAndLog("Samples:");
118 PrintAndLog(" hf legic dump");
119 PrintAndLog(" hf legic dump o myfile");
120 return 0;
121 }
122
123 int usage_legic_eload(void){
124 PrintAndLog("It loads binary dump from the file `filename.bin`");
125 PrintAndLog("Usage: hf legic eload [h] [card memory] <file name w/o `.bin`>");
126 PrintAndLog("Options:");
127 PrintAndLog(" h : this help");
128 PrintAndLog(" [card memory] : 0 = MIM22");
129 PrintAndLog(" : 1 = MIM256 (default)");
130 PrintAndLog(" : 2 = MIM1024");
131 PrintAndLog(" <filename> : filename w/o .bin to load");
132 PrintAndLog("");
133 PrintAndLog("Samples:");
134 PrintAndLog(" hf legic eload filename");
135 PrintAndLog(" hf legic eload 2 filename");
136 return 0;
137 }
138 int usage_legic_esave(void){
139 PrintAndLog("It saves binary dump into the file `filename.bin` or `cardID.bin`");
140 PrintAndLog(" Usage: hf legic esave [h] [card memory] [file name w/o `.bin`]");
141 PrintAndLog("Options:");
142 PrintAndLog(" h : this help");
143 PrintAndLog(" [card memory] : 0 = MIM22");
144 PrintAndLog(" : 1 = MIM256 (default)");
145 PrintAndLog(" : 2 = MIM1024");
146 PrintAndLog(" <filename> : filename w/o .bin to load");
147 PrintAndLog("");
148 PrintAndLog("Samples:");
149 PrintAndLog(" hf legic esave ");
150 PrintAndLog(" hf legic esave 2");
151 PrintAndLog(" hf legic esave 2 filename");
152 return 0;
153 }
154
155
156 /*
157 * Output BigBuf and deobfuscate LEGIC RF tag data.
158 * This is based on information given in the talk held
159 * by Henryk Ploetz and Karsten Nohl at 26c3
160 */
161 int CmdLegicInfo(const char *Cmd) {
162
163 char cmdp = param_getchar(Cmd, 0);
164 if ( cmdp == 'H' || cmdp == 'h' ) return usage_legic_info();
165
166 int i = 0, k = 0, segmentNum = 0, segment_len = 0, segment_flag = 0;
167 int crc = 0, wrp = 0, wrc = 0;
168 uint8_t stamp_len = 0;
169 uint8_t data[1024]; // receiver buffer
170 char token_type[5] = {0,0,0,0,0};
171 int dcf = 0;
172 int bIsSegmented = 0;
173
174 CmdLegicRdmem("0 22 55");
175
176 // copy data from device
177 GetEMLFromBigBuf(data, sizeof(data), 0);
178 if ( !WaitForResponseTimeout(CMD_ACK, NULL, 2000)){
179 PrintAndLog("Command execute timeout");
180 return 1;
181 }
182
183 // Output CDF System area (9 bytes) plus remaining header area (12 bytes)
184 crc = data[4];
185 uint32_t calc_crc = CRC8Legic(data, 4);
186
187 PrintAndLog("\nCDF: System Area");
188 PrintAndLog("------------------------------------------------------");
189 PrintAndLog("MCD: %02x, MSN: %02x %02x %02x, MCC: %02x %s",
190 data[0],
191 data[1],
192 data[2],
193 data[3],
194 data[4],
195 (calc_crc == crc) ? "OK":"Fail"
196 );
197
198 // MCD = Manufacturer ID (should be list meaning something?)
199
200 token_type[0] = 0;
201 dcf = ((int)data[6] << 8) | (int)data[5];
202
203 // New unwritten media?
204 if(dcf == 0xFFFF) {
205
206 PrintAndLog("DCF: %d (%02x %02x), Token Type=NM (New Media)",
207 dcf,
208 data[5],
209 data[6]
210 );
211
212 } else if(dcf > 60000) { // Master token?
213
214 int fl = 0;
215
216 if(data[6] == 0xec) {
217 strncpy(token_type, "XAM", sizeof(token_type));
218 fl = 1;
219 stamp_len = 0x0c - (data[5] >> 4);
220 } else {
221 switch (data[5] & 0x7f) {
222 case 0x00 ... 0x2f:
223 strncpy(token_type, "IAM", sizeof(token_type));
224 fl = (0x2f - (data[5] & 0x7f)) + 1;
225 break;
226 case 0x30 ... 0x6f:
227 strncpy(token_type, "SAM", sizeof(token_type));
228 fl = (0x6f - (data[5] & 0x7f)) + 1;
229 break;
230 case 0x70 ... 0x7f:
231 strncpy(token_type, "GAM", sizeof(token_type));
232 fl = (0x7f - (data[5] & 0x7f)) + 1;
233 break;
234 }
235
236 stamp_len = 0xfc - data[6];
237 }
238
239 PrintAndLog("DCF: %d (%02x %02x), Token Type=%s (OLE=%01u), OL=%02u, FL=%02u",
240 dcf,
241 data[5],
242 data[6],
243 token_type,
244 (data[5] & 0x80 )>> 7,
245 stamp_len,
246 fl
247 );
248
249 } else { // Is IM(-S) type of card...
250
251 if(data[7] == 0x9F && data[8] == 0xFF) {
252 bIsSegmented = 1;
253 strncpy(token_type, "IM-S", sizeof(token_type));
254 } else {
255 strncpy(token_type, "IM", sizeof(token_type));
256 }
257
258 PrintAndLog("DCF: %d (%02x %02x), Token Type=%s (OLE=%01u)",
259 dcf,
260 data[5],
261 data[6],
262 token_type,
263 (data[5]&0x80) >> 7
264 );
265 }
266
267 // Makes no sence to show this on blank media...
268 if(dcf != 0xFFFF) {
269
270 if(bIsSegmented) {
271 PrintAndLog("WRP=%02u, WRC=%01u, RD=%01u, SSC=%02x",
272 data[7] & 0x0f,
273 (data[7] & 0x70) >> 4,
274 (data[7] & 0x80) >> 7,
275 data[8]
276 );
277 }
278
279 // Header area is only available on IM-S cards, on master tokens this data is the master token data itself
280 if(bIsSegmented || dcf > 60000) {
281 if(dcf > 60000) {
282 PrintAndLog("Master token data");
283 PrintAndLog("%s", sprint_hex(data+8, 14));
284 } else {
285 PrintAndLog("Remaining Header Area");
286 PrintAndLog("%s", sprint_hex(data+9, 13));
287 }
288 }
289 }
290
291 uint8_t segCrcBytes[8] = {0,0,0,0,0,0,0,0};
292 uint32_t segCalcCRC = 0;
293 uint32_t segCRC = 0;
294
295 // Data card?
296 if(dcf <= 60000) {
297
298 PrintAndLog("\nADF: User Area");
299 PrintAndLog("------------------------------------------------------");
300
301 if(bIsSegmented) {
302
303 // Data start point on segmented cards
304 i = 22;
305
306 // decode segments
307 for (segmentNum=1; segmentNum < 128; segmentNum++ )
308 {
309 segment_len = ((data[i+1] ^ crc) & 0x0f) * 256 + (data[i] ^ crc);
310 segment_flag = ((data[i+1] ^ crc) & 0xf0) >> 4;
311 wrp = (data[i+2] ^ crc);
312 wrc = ((data[i+3] ^ crc) & 0x70) >> 4;
313
314 bool hasWRC = (wrc > 0);
315 bool hasWRP = (wrp > wrc);
316 int wrp_len = (wrp - wrc);
317 int remain_seg_payload_len = (segment_len - wrp - 5);
318
319 // validate segment-crc
320 segCrcBytes[0]=data[0]; //uid0
321 segCrcBytes[1]=data[1]; //uid1
322 segCrcBytes[2]=data[2]; //uid2
323 segCrcBytes[3]=data[3]; //uid3
324 segCrcBytes[4]=(data[i] ^ crc); //hdr0
325 segCrcBytes[5]=(data[i+1] ^ crc); //hdr1
326 segCrcBytes[6]=(data[i+2] ^ crc); //hdr2
327 segCrcBytes[7]=(data[i+3] ^ crc); //hdr3
328
329 segCalcCRC = CRC8Legic(segCrcBytes, 8);
330 segCRC = data[i+4] ^ crc;
331
332 PrintAndLog("Segment %02u \nraw header | 0x%02X 0x%02X 0x%02X 0x%02X \nSegment len: %u, Flag: 0x%X (valid:%01u, last:%01u), WRP: %02u, WRC: %02u, RD: %01u, CRC: 0x%02X (%s)",
333 segmentNum,
334 data[i] ^ crc,
335 data[i+1] ^ crc,
336 data[i+2] ^ crc,
337 data[i+3] ^ crc,
338 segment_len,
339 segment_flag,
340 (segment_flag & 0x4) >> 2,
341 (segment_flag & 0x8) >> 3,
342 wrp,
343 wrc,
344 ((data[i+3]^crc) & 0x80) >> 7,
345 segCRC,
346 ( segCRC == segCalcCRC ) ? "OK" : "fail"
347 );
348
349 i += 5;
350
351 if ( hasWRC ) {
352 PrintAndLog("WRC protected area: (I %d | K %d| WRC %d)", i, k, wrc);
353 PrintAndLog("\nrow | data");
354 PrintAndLog("-----+------------------------------------------------");
355
356 for ( k=i; k < (i + wrc); ++k)
357 data[k] ^= crc;
358
359 print_hex_break( data+i, wrc, 16);
360
361 i += wrc;
362 }
363
364 if ( hasWRP ) {
365 PrintAndLog("Remaining write protected area: (I %d | K %d | WRC %d | WRP %d WRP_LEN %d)",i, k, wrc, wrp, wrp_len);
366 PrintAndLog("\nrow | data");
367 PrintAndLog("-----+------------------------------------------------");
368
369 for (k=i; k < (i+wrp_len); ++k)
370 data[k] ^= crc;
371
372 print_hex_break( data+i, wrp_len, 16);
373
374 i += wrp_len;
375
376 // does this one work? (Answer: Only if KGH/BGH is used with BCD encoded card number! So maybe this will show just garbage...)
377 if( wrp_len == 8 )
378 PrintAndLog("Card ID: %2X%02X%02X", data[i-4]^crc, data[i-3]^crc, data[i-2]^crc);
379 }
380
381 PrintAndLog("Remaining segment payload: (I %d | K %d | Remain LEN %d)", i, k, remain_seg_payload_len);
382 PrintAndLog("\nrow | data");
383 PrintAndLog("-----+------------------------------------------------");
384
385 for ( k=i; k < (i+remain_seg_payload_len); ++k)
386 data[k] ^= crc;
387
388 print_hex_break( data+i, remain_seg_payload_len, 16);
389
390 i += remain_seg_payload_len;
391
392 PrintAndLog("-----+------------------------------------------------\n");
393
394 // end with last segment
395 if (segment_flag & 0x8) return 0;
396
397 } // end for loop
398
399 } else {
400
401 // Data start point on unsegmented cards
402 i = 8;
403
404 wrp = data[7] & 0x0F;
405 wrc = (data[7] & 0x70) >> 4;
406
407 bool hasWRC = (wrc > 0);
408 bool hasWRP = (wrp > wrc);
409 int wrp_len = (wrp - wrc);
410 int remain_seg_payload_len = (1024 - 22 - wrp); // Any chance to get physical card size here!?
411
412 PrintAndLog("Unsegmented card - WRP: %02u, WRC: %02u, RD: %01u",
413 wrp,
414 wrc,
415 (data[7] & 0x80) >> 7
416 );
417
418 if ( hasWRC ) {
419 PrintAndLog("WRC protected area: (I %d | WRC %d)", i, wrc);
420 PrintAndLog("\nrow | data");
421 PrintAndLog("-----+------------------------------------------------");
422 print_hex_break( data+i, wrc, 16);
423 i += wrc;
424 }
425
426 if ( hasWRP ) {
427 PrintAndLog("Remaining write protected area: (I %d | WRC %d | WRP %d | WRP_LEN %d)", i, wrc, wrp, wrp_len);
428 PrintAndLog("\nrow | data");
429 PrintAndLog("-----+------------------------------------------------");
430 print_hex_break( data + i, wrp_len, 16);
431 i += wrp_len;
432
433 // does this one work? (Answer: Only if KGH/BGH is used with BCD encoded card number! So maybe this will show just garbage...)
434 if( wrp_len == 8 )
435 PrintAndLog("Card ID: %2X%02X%02X", data[i-4], data[i-3], data[i-2]);
436 }
437
438 PrintAndLog("Remaining segment payload: (I %d | Remain LEN %d)", i, remain_seg_payload_len);
439 PrintAndLog("\nrow | data");
440 PrintAndLog("-----+------------------------------------------------");
441 print_hex_break( data + i, remain_seg_payload_len, 16);
442 i += remain_seg_payload_len;
443
444 PrintAndLog("-----+------------------------------------------------\n");
445 }
446 }
447 return 0;
448 }
449
450 int CmdLegicRdmem(const char *Cmd) {
451
452 // params:
453 // offset in data memory
454 // number of bytes to read
455 char cmdp = param_getchar(Cmd, 0);
456 if ( cmdp == 'H' || cmdp == 'h' ) return usage_legic_rdmem();
457
458 uint32_t offset = 0, len = 0, IV = 1;
459 sscanf(Cmd, "%x %x %x", &offset, &len, &IV);
460
461 // OUT-OF-BOUNDS check
462 if ( len + offset > MAX_LENGTH ) {
463 len = MAX_LENGTH - offset;
464 PrintAndLog("Out-of-bound, shorten len to %d (0x%02X)", len, len);
465 }
466
467 legic_chk_iv(&IV);
468
469 UsbCommand c = {CMD_READER_LEGIC_RF, {offset, len, IV}};
470 clearCommandBuffer();
471 SendCommand(&c);
472 UsbCommand resp;
473 if (WaitForResponseTimeout(CMD_ACK, &resp, 3000)) {
474 uint8_t isOK = resp.arg[0] & 0xFF;
475 uint16_t readlen = resp.arg[1];
476 if ( isOK ) {
477
478 uint8_t *data = malloc(readlen);
479 if ( !data ){
480 PrintAndLog("Cannot allocate memory");
481 return 2;
482 }
483
484 if ( readlen != len )
485 PrintAndLog("Fail, only managed to read 0x%02X bytes", readlen);
486
487 // copy data from device
488 GetEMLFromBigBuf(data, readlen, 0);
489 if ( !WaitForResponseTimeout(CMD_ACK, NULL, 2500)){
490 PrintAndLog("Command execute timeout");
491 if ( data )
492 free(data);
493 return 1;
494 }
495
496 PrintAndLog("\n ## | Data");
497 PrintAndLog("-----+-----");
498 print_hex_break( data, readlen, 32);
499 } else {
500 PrintAndLog("failed reading tag");
501 }
502 } else {
503 PrintAndLog("command execution time out");
504 return 1;
505 }
506 return 0;
507 }
508
509 // load, filename (ascii hex textfile)
510 // uploads it to device mem
511 int CmdLegicLoad(const char *Cmd) {
512
513 // iceman: potential bug, where all filepaths or filename which starts with H or h will print the helptext :)
514 char cmdp = param_getchar(Cmd, 0);
515 if ( cmdp == 'H' || cmdp == 'h' || cmdp == 0x00) return usage_legic_load();
516
517 char filename[FILE_PATH_SIZE] = {0x00};
518 int len = strlen(Cmd);
519
520 if (len > FILE_PATH_SIZE) {
521 PrintAndLog("Filepath too long (was %s bytes), max allowed is %s ", len, FILE_PATH_SIZE);
522 return 0;
523 }
524 memcpy(filename, Cmd, len);
525
526 FILE *f = fopen(filename, "r");
527 if(!f) {
528 PrintAndLog("couldn't open '%s'", Cmd);
529 return -1;
530 }
531
532 char line[80];
533 int offset = 0;
534 uint8_t data[USB_CMD_DATA_SIZE] = {0x00};
535 int index = 0;
536 int totalbytes = 0;
537 while ( fgets(line, sizeof(line), f) ) {
538 int res = sscanf(line, "%x %x %x %x %x %x %x %x",
539 (unsigned int *)&data[index],
540 (unsigned int *)&data[index + 1],
541 (unsigned int *)&data[index + 2],
542 (unsigned int *)&data[index + 3],
543 (unsigned int *)&data[index + 4],
544 (unsigned int *)&data[index + 5],
545 (unsigned int *)&data[index + 6],
546 (unsigned int *)&data[index + 7]);
547
548 if(res != 8) {
549 PrintAndLog("Error: could not read samples");
550 fclose(f);
551 return -1;
552 }
553 index += res;
554
555 if ( index == USB_CMD_DATA_SIZE ){
556 // PrintAndLog("sent %d | %d | %d", index, offset, totalbytes);
557 UsbCommand c = { CMD_DOWNLOADED_SIM_SAMPLES_125K, {offset, 0, 0}};
558 memcpy(c.d.asBytes, data, sizeof(data));
559 clearCommandBuffer();
560 SendCommand(&c);
561 if ( !WaitForResponseTimeout(CMD_ACK, NULL, 1500)){
562 PrintAndLog("Command execute timeout");
563 fclose(f);
564 return 1;
565 }
566 offset += index;
567 totalbytes += index;
568 index = 0;
569 }
570 }
571 fclose(f);
572
573 // left over bytes?
574 if ( index != 0 ) {
575 UsbCommand c = { CMD_DOWNLOADED_SIM_SAMPLES_125K, {offset, 0, 0}};
576 memcpy(c.d.asBytes, data, 8);
577 clearCommandBuffer();
578 SendCommand(&c);
579 if ( !WaitForResponseTimeout(CMD_ACK, NULL, 1500)){
580 PrintAndLog("Command execute timeout");
581 return 1;
582 }
583 totalbytes += index;
584 }
585
586 PrintAndLog("loaded %u samples", totalbytes);
587 return 0;
588 }
589
590 // Save, filename, num of bytes, starting offset. (in decimal)
591 // ie: "hf legic save nnn.txt 100 0 (saves the first 100bytes)
592 // (ascii hex textfile)
593 int CmdLegicSave(const char *Cmd) {
594 int requested = 1024;
595 int offset = 0;
596 int delivered = 0;
597 char filename[FILE_PATH_SIZE] = {0x00};
598 uint8_t got[1024] = {0x00};
599
600 memset(filename, 0, FILE_PATH_SIZE);
601
602 sscanf(Cmd, " %s %i %i", filename, &requested, &offset);
603
604 /* If no length given save entire legic read buffer */
605 /* round up to nearest 8 bytes so the saved data can be used with legicload */
606 if (requested == 0)
607 requested = 1024;
608
609 if (requested % 8 != 0) {
610 int remainder = requested % 8;
611 requested = requested + 8 - remainder;
612 }
613
614 if (offset + requested > sizeof(got)) {
615 PrintAndLog("Tried to read past end of buffer, <bytes> + <offset> > 1024");
616 return 0;
617 }
618
619 GetFromBigBuf(got, requested, offset);
620 if ( !WaitForResponseTimeout(CMD_ACK, NULL, 2000)){
621 PrintAndLog("Command execute timeout");
622 return 1;
623 }
624
625 FILE *f = fopen(filename, "w");
626 if(!f) {
627 PrintAndLog("couldn't open '%s'", Cmd+1);
628 return -1;
629 }
630
631 for (int j = 0; j < requested; j += 8) {
632 fprintf(f, "%02x %02x %02x %02x %02x %02x %02x %02x\n",
633 got[j+0], got[j+1], got[j+2], got[j+3],
634 got[j+4], got[j+5], got[j+6], got[j+7]
635 );
636 delivered += 8;
637 if (delivered >= requested) break;
638 }
639
640 fclose(f);
641 PrintAndLog("saved %u samples", delivered);
642 return 0;
643 }
644
645 //TODO: write a help text (iceman)
646 // should say which tagtype
647 // should load a tag to device mem.
648 int CmdLegicRfSim(const char *Cmd) {
649 UsbCommand c = {CMD_SIMULATE_TAG_LEGIC_RF, {6,3,0}};
650 sscanf(Cmd, " %"lli" %"lli" %"lli, &c.arg[0], &c.arg[1], &c.arg[2]);
651 clearCommandBuffer();
652 SendCommand(&c);
653 return 0;
654 }
655
656 int CmdLegicRfWrite(const char *Cmd) {
657
658 // offset - in tag memory
659 // length - num of bytes to be written
660
661 char cmdp = param_getchar(Cmd, 0);
662 if ( cmdp == 'H' || cmdp == 'h' ) return usage_legic_write();
663
664 uint32_t offset = 0, len = 0, IV = 0;
665
666 int res = sscanf(Cmd, "%x %x %x", &offset, &len, &IV);
667 if(res < 2) {
668 PrintAndLog("Please specify the offset and length as two hex strings and, optionally, the IV also as an hex string");
669 return -1;
670 }
671
672 // tagtype
673 legic_card_select_t card;
674 if (legic_get_type(&card)) {
675 PrintAndLog("Failed to identify tagtype");
676 return -1;
677 }
678
679 legic_print_type(card.cardsize, 0);
680
681 // OUT-OF-BOUNDS check
682 if ( len + offset > card.cardsize ) {
683 PrintAndLog("Out-of-bounds, Cardsize = %d, [offset+len = %d ]", card.cardsize, len + offset);
684 return -2;
685 }
686
687 legic_chk_iv(&IV);
688
689 UsbCommand c = {CMD_WRITER_LEGIC_RF, {offset, len, IV}};
690 clearCommandBuffer();
691 SendCommand(&c);
692 UsbCommand resp;
693 if (WaitForResponseTimeout(CMD_ACK, &resp, 2000)) {
694 uint8_t isOK = resp.arg[0] & 0xFF;
695 if ( !isOK )
696 PrintAndLog("failed writing tag");
697 } else {
698 PrintAndLog("command execution time out");
699 return 1;
700 }
701
702 return 0;
703 }
704
705 int CmdLegicRfRawWrite(const char *Cmd) {
706
707 char cmdp = param_getchar(Cmd, 0);
708 if ( cmdp == 'H' || cmdp == 'h' ) return usage_legic_rawwrite();
709
710 uint32_t offset = 0, data = 0, IV = 0;
711 char answer;
712
713 int res = sscanf(Cmd, "%x %x %x", &offset, &data, &IV);
714 if(res < 2)
715 return usage_legic_rawwrite();
716
717 // OUT-OF-BOUNDS check
718 if ( offset > MAX_LENGTH ) {
719 PrintAndLog("Out-of-bound, offset");
720 return 1;
721 }
722
723 if ( (IV & 0x7F) != IV ){
724 IV &= 0x7F;
725 PrintAndLog("Truncating IV to 7bits");
726 }
727 if ( (IV & 1) == 0 ){
728 IV |= 0x01; // IV must be odd
729 PrintAndLog("LSB of IV must be SET");
730 }
731
732 UsbCommand c = { CMD_RAW_WRITER_LEGIC_RF, {offset, data, IV} };
733
734 if (c.arg[0] == 0x05 || c.arg[0] == 0x06) {
735 PrintAndLog("############# DANGER !! #############");
736 PrintAndLog("# changing the DCF is irreversible #");
737 PrintAndLog("#####################################");
738 PrintAndLog("do youe really want to continue? y(es) n(o)");
739 if (scanf(" %c", &answer) > 0 && (answer == 'y' || answer == 'Y')) {
740 SendCommand(&c);
741 return 0;
742 }
743 return -1;
744 }
745
746 clearCommandBuffer();
747 SendCommand(&c);
748 return 0;
749 }
750
751 void static calc4(uint8_t *cmd, uint8_t len){
752 crc_t crc;
753 //crc_init_ref(&crc, 4, 0x19 >> 1, 0x5, 0, TRUE, TRUE);
754 crc_init(&crc, 4, 0x19 >> 1, 0x5, 0);
755
756 crc_clear(&crc);
757 crc_update(&crc, 1, 1); /* CMD_READ */
758 crc_update(&crc, cmd[0], 8);
759 crc_update(&crc, cmd[1], 8);
760 printf("crc4 %X\n", reflect(crc_finish(&crc), 4) ) ;
761
762 crc_clear(&crc);
763 crc_update(&crc, 1, 1); /* CMD_READ */
764 crc_update(&crc, cmd[0], 8);
765 crc_update(&crc, cmd[1], 8);
766 printf("crc4 %X\n", crc_finish(&crc) ) ;
767
768 printf("---- old ---\n");
769 crc_update2(&crc, 1, 1); /* CMD_READ */
770 crc_update2(&crc, cmd[0], 8);
771 crc_update2(&crc, cmd[1], 8);
772 printf("crc4 %X \n", reflect(crc_finish(&crc), 4) ) ;
773
774
775 crc_clear(&crc);
776 crc_update2(&crc, 1, 1); /* CMD_READ */
777 crc_update2(&crc, cmd[0], 8);
778 crc_update2(&crc, cmd[1], 8);
779 printf("crc4 %X\n", crc_finish(&crc) ) ;
780 }
781
782 int CmdLegicCalcCrc8(const char *Cmd){
783
784 uint8_t *data = NULL;
785 uint8_t cmdp = 0, uidcrc = 0, type=0;
786 bool errors = false;
787 int len = 0;
788 int bg, en;
789
790 while(param_getchar(Cmd, cmdp) != 0x00) {
791 switch(param_getchar(Cmd, cmdp)) {
792 case 'b':
793 case 'B':
794 // peek at length of the input string so we can
795 // figure out how many elements to malloc in "data"
796 bg=en=0;
797 if (param_getptr(Cmd, &bg, &en, cmdp+1)) {
798 errors = true;
799 break;
800 }
801 len = (en - bg + 1);
802
803 // check that user entered even number of characters
804 // for hex data string
805 if (len & 1) {
806 errors = true;
807 break;
808 }
809
810 // it's possible for user to accidentally enter "b" parameter
811 // more than once - we have to clean previous malloc
812 if (data) free(data);
813 data = malloc(len >> 1);
814 if ( data == NULL ) {
815 PrintAndLog("Can't allocate memory. exiting");
816 errors = true;
817 break;
818 }
819
820 if (param_gethex(Cmd, cmdp+1, data, len)) {
821 errors = true;
822 break;
823 }
824
825 len >>= 1;
826 cmdp += 2;
827 break;
828 case 'u':
829 case 'U':
830 uidcrc = param_get8ex(Cmd, cmdp+1, 0, 16);
831 cmdp += 2;
832 break;
833 case 'c':
834 case 'C':
835 type = param_get8ex(Cmd, cmdp+1, 0, 10);
836 cmdp += 2;
837 break;
838 case 'h':
839 case 'H':
840 errors = true;
841 break;
842 default:
843 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
844 errors = true;
845 break;
846 }
847 if (errors) break;
848 }
849 //Validations
850 if (errors){
851 if (data) free(data);
852 return usage_legic_calccrc8();
853 }
854
855 switch (type){
856 case 16:
857 PrintAndLog("Legic crc16: %X", CRC16Legic(data, len, uidcrc));
858 break;
859 case 4:
860 calc4(data, 0);
861 break;
862 default:
863 PrintAndLog("Legic crc8: %X", CRC8Legic(data, len) );
864 break;
865 }
866
867 if (data) free(data);
868 return 0;
869 }
870
871 int legic_print_type(uint32_t tagtype, uint8_t spaces){
872 char spc[11] = " ";
873 spc[10]=0x00;
874 char *spacer = spc + (10-spaces);
875
876 if ( tagtype == 22 )
877 PrintAndLog("%sTYPE : MIM%d card (outdated)", spacer, tagtype);
878 else if ( tagtype == 256 )
879 PrintAndLog("%sTYPE : MIM%d card (234 bytes)", spacer, tagtype);
880 else if ( tagtype == 1024 )
881 PrintAndLog("%sTYPE : MIM%d card (1002 bytes)", spacer, tagtype);
882 else
883 PrintAndLog("%sTYPE : Unknown %06x", spacer, tagtype);
884 return 0;
885 }
886 int legic_get_type(legic_card_select_t *card){
887
888 if ( card == NULL ) return 1;
889
890 UsbCommand c = {CMD_LEGIC_INFO, {0,0,0}};
891 clearCommandBuffer();
892 SendCommand(&c);
893 UsbCommand resp;
894 if (!WaitForResponseTimeout(CMD_ACK, &resp, 500))
895 return 2;
896
897 uint8_t isOK = resp.arg[0] & 0xFF;
898 if ( !isOK )
899 return 3;
900
901 memcpy(card, (legic_card_select_t *)resp.d.asBytes, sizeof(legic_card_select_t));
902 return 0;
903 }
904 void legic_chk_iv(uint32_t *iv){
905 if ( (*iv & 0x7F) != *iv ){
906 *iv &= 0x7F;
907 PrintAndLog("Truncating IV to 7bits, %u", *iv);
908 }
909 // IV must be odd
910 if ( (*iv & 1) == 0 ){
911 *iv |= 0x01;
912 PrintAndLog("LSB of IV must be SET %u", *iv);
913 }
914 }
915
916 void legic_seteml(uint8_t *src, uint32_t offset, uint32_t numofbytes) {
917
918 size_t len = 0;
919 UsbCommand c = {CMD_LEGIC_ESET, {0, 0, 0}};
920
921 for(size_t i = 0; i < numofbytes; i += USB_CMD_DATA_SIZE) {
922
923 len = MIN((numofbytes - i), USB_CMD_DATA_SIZE);
924 c.arg[0] = i; // offset
925 c.arg[1] = len; // number of bytes
926 memcpy(c.d.asBytes, src, len);
927 clearCommandBuffer();
928 SendCommand(&c);
929 PrintAndLog("ICE: offset %d | len %d", i, len);
930 }
931 }
932
933 int HFLegicReader(const char *Cmd, bool verbose) {
934
935 char cmdp = param_getchar(Cmd, 0);
936 if ( cmdp == 'H' || cmdp == 'h' ) return usage_legic_reader();
937
938 legic_card_select_t card;
939 switch(legic_get_type(&card)){
940 case 1:
941 if ( verbose ) PrintAndLog("command execution time out");
942 return 1;
943 case 2:
944 case 3:
945 if ( verbose ) PrintAndLog("legic card select failed");
946 return 2;
947 default: break;
948 }
949 PrintAndLog(" UID : %s", sprint_hex(card.uid, sizeof(card.uid)));
950 legic_print_type(card.cardsize, 0);
951 return 0;
952 }
953 int CmdLegicReader(const char *Cmd){
954 return HFLegicReader(Cmd, TRUE);
955 }
956
957 int CmdLegicDump(const char *Cmd){
958
959 FILE *f;
960 char filename[FILE_PATH_SIZE] = {0x00};
961 char *fnameptr = filename;
962 size_t fileNlen = 0;
963 bool errors = false;
964 uint16_t dumplen;
965 uint8_t cmdp = 0;
966
967 memset(filename, 0, sizeof(filename));
968
969 while(param_getchar(Cmd, cmdp) != 0x00) {
970 switch(param_getchar(Cmd, cmdp)) {
971 case 'h':
972 case 'H':
973 return usage_legic_dump();
974 case 'o':
975 case 'O':
976 fileNlen = param_getstr(Cmd, cmdp+1, filename);
977 if (!fileNlen)
978 errors = true;
979 if (fileNlen > FILE_PATH_SIZE-5)
980 fileNlen = FILE_PATH_SIZE-5;
981 cmdp += 2;
982 break;
983 default:
984 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
985 errors = true;
986 break;
987 }
988 if(errors) break;
989 }
990
991 //Validations
992 if(errors) return usage_legic_dump();
993
994 // tagtype
995 legic_card_select_t card;
996 if (legic_get_type(&card)) {
997 PrintAndLog("Failed to identify tagtype");
998 return -1;
999 }
1000 dumplen = card.cardsize;
1001
1002 legic_print_type(dumplen, 0);
1003 PrintAndLog("Reading tag memory...");
1004
1005 UsbCommand c = {CMD_READER_LEGIC_RF, {0x00, dumplen, 0x55}};
1006 clearCommandBuffer();
1007 SendCommand(&c);
1008 UsbCommand resp;
1009 if (!WaitForResponseTimeout(CMD_ACK, &resp, 3000)) {
1010 PrintAndLog("Command execute time-out");
1011 return 1;
1012 }
1013
1014 uint8_t isOK = resp.arg[0] & 0xFF;
1015 if ( !isOK ) {
1016 PrintAndLog("Failed dumping tag data");
1017 return 2;
1018 }
1019
1020 uint16_t readlen = resp.arg[1];
1021 uint8_t *data = malloc(readlen);
1022 if (!data) {
1023 PrintAndLog("Fail, cannot allocate memory");
1024 return 3;
1025 }
1026
1027 if ( readlen != dumplen )
1028 PrintAndLog("Fail, only managed to read 0x%02X bytes of 0x%02X", readlen, dumplen);
1029
1030 // copy data from device
1031 GetEMLFromBigBuf(data, readlen, 0);
1032 if ( !WaitForResponseTimeout(CMD_ACK, NULL, 2500)) {
1033 PrintAndLog("Fail, transfer from device time-out");
1034 free(data);
1035 return 4;
1036 }
1037
1038 // user supplied filename?
1039 if (fileNlen < 1)
1040 sprintf(fnameptr,"%02X%02X%02X%02X.bin", data[0], data[1], data[2], data[3]);
1041 else
1042 sprintf(fnameptr + fileNlen,".bin");
1043
1044 if ((f = fopen(filename,"wb")) == NULL) {
1045 PrintAndLog("Could not create file name %s", filename);
1046 if (data)
1047 free(data);
1048 return 5;
1049 }
1050 fwrite(data, 1, readlen, f);
1051 fclose(f);
1052 free(data);
1053 PrintAndLog("Wrote %d bytes to %s", readlen, filename);
1054 return 0;
1055 }
1056
1057 int CmdLegicELoad(const char *Cmd) {
1058 FILE * f;
1059 char filename[FILE_PATH_SIZE];
1060 char *fnameptr = filename;
1061 int len, numofbytes;
1062 int nameParamNo = 1;
1063
1064 char cmdp = param_getchar(Cmd, 0);
1065 if ( cmdp == 'h' || cmdp == 'H' || cmdp == 0x00)
1066 return usage_legic_eload();
1067
1068 switch (cmdp) {
1069 case '0' : numofbytes = 22; break;
1070 case '1' :
1071 case '\0': numofbytes = 256; break;
1072 case '2' : numofbytes = 1024; break;
1073 default : numofbytes = 256; nameParamNo = 0;break;
1074 }
1075
1076 // set up buffer
1077 uint8_t *data = malloc(numofbytes);
1078 if (!data) {
1079 PrintAndLog("Fail, cannot allocate memory");
1080 return 3;
1081 }
1082 memset(data, 0, numofbytes);
1083
1084 // set up file
1085 len = param_getstr(Cmd, nameParamNo, filename);
1086 if (len > FILE_PATH_SIZE - 5)
1087 len = FILE_PATH_SIZE - 5;
1088 fnameptr += len;
1089 sprintf(fnameptr, ".bin");
1090
1091 // open file
1092 if ((f = fopen(filename,"rb")) == NULL) {
1093 PrintAndLog("File %s not found or locked", filename);
1094 free(data);
1095 return 1;
1096 }
1097
1098 // load file
1099 size_t bytes_read = fread(data, 1, numofbytes, f);
1100 if ( bytes_read == 0){
1101 PrintAndLog("File reading error");
1102 free(data);
1103 fclose(f);
1104 return 2;
1105 }
1106 fclose(f);
1107
1108 // transfer to device
1109 legic_seteml(data, 0, numofbytes);
1110
1111 free(data);
1112 PrintAndLog("\nLoaded %d bytes from file: %s to emulator memory", numofbytes, filename);
1113 return 0;
1114 }
1115
1116 int CmdLegicESave(const char *Cmd) {
1117 FILE *f;
1118 char filename[FILE_PATH_SIZE];
1119 char *fnameptr = filename;
1120 int fileNlen, numofbytes, nameParamNo = 1;
1121
1122 memset(filename, 0, sizeof(filename));
1123
1124 char cmdp = param_getchar(Cmd, 0);
1125
1126 if ( cmdp == 'h' || cmdp == 'H' || cmdp == 0x00)
1127 return usage_legic_esave();
1128
1129 switch (cmdp) {
1130 case '0' : numofbytes = 22; break;
1131 case '1' :
1132 case '\0': numofbytes = 256; break;
1133 case '2' : numofbytes = 1024; break;
1134 default : numofbytes = 256; nameParamNo = 0; break;
1135 }
1136
1137 fileNlen = param_getstr(Cmd, nameParamNo, filename);
1138
1139 if (fileNlen > FILE_PATH_SIZE - 5)
1140 fileNlen = FILE_PATH_SIZE - 5;
1141
1142 // set up buffer
1143 uint8_t *data = malloc(numofbytes);
1144 if (!data) {
1145 PrintAndLog("Fail, cannot allocate memory");
1146 return 3;
1147 }
1148 memset(data, 0, numofbytes);
1149
1150 // download emulator memory
1151 PrintAndLog("Reading emulator memory...");
1152
1153 GetEMLFromBigBuf(data, numofbytes, 0);
1154 if ( !WaitForResponseTimeout(CMD_ACK, NULL, 2500)) {
1155 PrintAndLog("Fail, transfer from device time-out");
1156 free(data);
1157 return 4;
1158 }
1159
1160 // user supplied filename?
1161 if (fileNlen < 1)
1162 sprintf(fnameptr,"%02X%02X%02X%02X.bin", data[0], data[1], data[2], data[3]);
1163 else
1164 sprintf(fnameptr + fileNlen,".bin");
1165
1166 // open file
1167 if ((f = fopen(filename,"wb")) == NULL) {
1168 PrintAndLog("Could not create file name %s", filename);
1169 free(data);
1170 return 1;
1171 }
1172 fwrite(data, 1, numofbytes, f);
1173 fclose(f);
1174 free(data);
1175 PrintAndLog("\nSaved %d bytes from emulator memory to file: %s", numofbytes, filename);
1176 return 0;
1177 }
1178
1179 static command_t CommandTable[] = {
1180 {"help", CmdHelp, 1, "This help"},
1181 {"reader", CmdLegicReader, 1, "LEGIC Prime Reader UID and Type tag info"},
1182 {"info", CmdLegicInfo, 0, "Display deobfuscated and decoded LEGIC Prime tag data"},
1183 {"dump", CmdLegicDump, 0, "Dump LEGIC Prime card to binary file"},
1184 {"rdmem", CmdLegicRdmem, 0, "[offset][length] <iv> -- read bytes from a LEGIC card"},
1185 {"save", CmdLegicSave, 0, "<filename> [<length>] -- Store samples"},
1186 {"load", CmdLegicLoad, 0, "<filename> -- Restore samples"},
1187 {"sim", CmdLegicRfSim, 0, "[phase drift [frame drift [req/resp drift]]] Start tag simulator (use after load or read)"},
1188 {"write", CmdLegicRfWrite, 0, "<offset> <length> <iv> -- Write sample buffer (user after load or read)"},
1189 {"crc8", CmdLegicCalcCrc8, 1, "Calculate Legic CRC8 over given hexbytes"},
1190 {"eload", CmdLegicELoad, 1, "Load binary dump to emulator memory"},
1191 {"esave", CmdLegicESave, 1, "Save emulator memory to binary file"},
1192 {NULL, NULL, 0, NULL}
1193 };
1194
1195 int CmdHFLegic(const char *Cmd) {
1196 clearCommandBuffer();
1197 CmdsParse(CommandTable, Cmd);
1198 return 0;
1199 }
1200
1201 int CmdHelp(const char *Cmd) {
1202 CmdsHelp(CommandTable);
1203 return 0;
1204 }
Proxmark3 GIT tracking
Impressum, Datenschutz