7 #include "cmdhflegic.h"
10 static int CmdHelp(const char *Cmd
);
12 static command_t CommandTable
[] =
14 {"help", CmdHelp
, 1, "This help"},
15 {"decode", CmdLegicDecode
, 0, "Display deobfuscated and decoded LEGIC RF tag data (use after hf legic reader)"},
16 {"reader", CmdLegicRFRead
, 0, "[offset [length]] -- read bytes from a LEGIC card"},
20 int CmdHFLegic(const char *Cmd
)
22 CmdsParse(CommandTable
, Cmd
);
26 int CmdHelp(const char *Cmd
)
28 CmdsHelp(CommandTable
);
33 * Output BigBuf and deobfuscate LEGIC RF tag data.
34 * This is based on information given in the talk held
35 * by Henryk Ploetz and Karsten Nohl at 26c3
36 * FIXME: will crash if sample buffer does not contain valid legic data
38 int CmdLegicDecode(const char *Cmd
)
47 int data_buf
[1032]; // receiver buffer
48 char out_string
[3076]; // just use big buffer - bad practice
54 // copy data from proxmark into buffer
55 for (i
= 0; i
< 256; i
+= 12, h
+= 48) {
56 UsbCommand c
= {CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K
, {i
, 0, 0}};
58 WaitForResponse(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K
);
60 for (j
= 0; j
< 48; j
+= 8) {
61 for (k
= 0; k
< 8; k
++) {
62 data_buf
[h
+j
+k
] = sample_buf
[j
+k
];
65 if (delivered
>= 1024)
70 // Output CDF System area (9 bytes) plus remaining header area (12 bytes)
72 PrintAndLog("\nCDF: System Area");
74 PrintAndLog("MCD: %02x, MSN: %02x %02x %02x, MCC: %02x",
84 switch (data_buf
[5]&0x7f) {
86 strncpy(token_type
, "IAM",sizeof(token_type
));
89 strcpy(token_type
, "SAM");
92 strcpy(token_type
, "GAM");
95 strcpy(token_type
, "???");
99 stamp_len
= 0xfc - data_buf
[6];
101 PrintAndLog("DCF: %02x %02x, Token_Type=%s (OLE=%01u), Stamp_len=%02u",
105 (data_buf
[5]&0x80)>>7,
109 PrintAndLog("WRP=%02u, WRC=%01u, RD=%01u, raw=%02x, SSC=%02x",
111 (data_buf
[7]&0x70)>>4,
112 (data_buf
[7]&0x80)>>7,
117 PrintAndLog("Remaining Header Area");
119 PrintAndLog("%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x",
135 PrintAndLog("\nADF: User Area");
138 for (n
=0; n
<64; n
++) {
139 segment_len
= ((data_buf
[i
+1]^crc
)&0x0f) * 256 + (data_buf
[i
]^crc
);
140 segment_flag
= ((data_buf
[i
+1]^crc
)&0xf0)>>4;
142 wrp
= (data_buf
[i
+2]^crc
);
143 wrc
= ((data_buf
[i
+3]^crc
)&0x70)>>4;
145 PrintAndLog("Segment %02u: raw header=%02x %02x %02x %02x, flag=%01x (valid=%01u, last=%01u), len=%04u, WRP=%02u, WRC=%02u, RD=%01u, CRC=%02x",
152 (segment_flag
&0x4)>>2,
153 (segment_flag
&0x8)>>3,
157 ((data_buf
[i
+3]^crc
)&0x80)>>7,
164 PrintAndLog("WRC protected area:");
165 for (k
=0, j
=0; k
< wrc
; k
++, i
++, j
+= 3) {
166 sprintf(&out_string
[j
], "%02x", (data_buf
[i
]^crc
));
167 out_string
[j
+2] = ' ';
170 out_string
[j
] = '\0';
172 PrintAndLog("%s", out_string
);
176 PrintAndLog("Remaining write protected area:");
178 for (k
=0, j
=0; k
< (wrp
-wrc
); k
++, i
++, j
+= 3) {
179 sprintf(&out_string
[j
], "%02x", (data_buf
[i
]^crc
));
180 out_string
[j
+2] = ' ';
183 out_string
[j
] = '\0';
185 PrintAndLog("%s", out_string
);
187 sprintf(out_string
,"Card ID: %2X%02X%02X",data_buf
[i
-4]^crc
,data_buf
[i
-3]^crc
,data_buf
[i
-2]^crc
);
188 PrintAndLog("%s", out_string
);
192 PrintAndLog("Remaining segment payload:");
193 for (k
=0, j
=0; k
< (segment_len
- wrp
- 5); k
++, i
++, j
+= 3) {
194 sprintf(&out_string
[j
], "%02x", (data_buf
[i
]^crc
));
195 out_string
[j
+2] = ' ';
198 out_string
[j
] = '\0';
200 PrintAndLog("%s", out_string
);
202 // end with last segment
203 if (segment_flag
& 0x8)
209 int CmdLegicRFRead(const char *Cmd
)
211 int byte_count
=0,offset
=0;
212 sscanf(Cmd
, "%i %i", &offset
, &byte_count
);
213 if(byte_count
== 0) byte_count
= 256;
214 if(byte_count
+ offset
> 256) byte_count
= 256 - offset
;
215 UsbCommand c
={CMD_READER_LEGIC_RF
, {offset
, byte_count
, 0}};