]>
cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlffdx.c
bc67ade5f2b4bf9f213cbeed0b27e4b0fe1a81ed
1 //-----------------------------------------------------------------------------
3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
4 // at your option, any later version. See the LICENSE.txt file for the text of
6 //-----------------------------------------------------------------------------
7 // Low frequency Presco tag commands
8 //-----------------------------------------------------------------------------
13 FDX-B ISO11784/85 demod (aka animal tag) BIPHASE, inverted, rf/32, with preamble of 00000000001 (128bits)
14 8 databits + 1 parity (1)
16 NATIONAL CODE, ICAR database
17 COUNTRY CODE (ISO3166) or http://cms.abvma.ca/uploads/ManufacturersISOsandCountryCodes.pdf
18 FLAG (animal/non-animal)
25 16 ccitt CRC chksum over 64bit ID CODE.
28 sample: 985121004515220 [ 37FF65B88EF94 ]
31 static int CmdHelp(const char *Cmd
);
33 int usage_lf_fdx_clone(void){
34 PrintAndLog("clone a FDX-B Animal tag to a T55x7 tag.");
35 PrintAndLog("Usage: lf fdx clone [h] <country id> <animal id> <Q5>");
36 PrintAndLog("Options:");
37 PrintAndLog(" h : This help");
38 PrintAndLog(" <country id> : Country id");
39 PrintAndLog(" <animal id> : Animal id");
44 PrintAndLog(" <Q5> : specify write to Q5 (t5555 instead of t55x7)");
46 PrintAndLog("Sample: lf fdx clone 999 112233");
50 int usage_lf_fdx_sim(void) {
51 PrintAndLog("Enables simulation of FDX-B Animal tag");
52 PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
54 PrintAndLog("Usage: lf fdx sim [h] <country id> <animal id>");
55 PrintAndLog("Options:");
56 PrintAndLog(" h : This help");
57 PrintAndLog(" <country id> : Country id");
58 PrintAndLog(" <animal id> : Animal id");
60 PrintAndLog("Sample: lf fdx sim 999 112233");
63 // clearing the topbit needed for the preambl detection.
64 static void verify_values(uint32_t countryid
, uint64_t animalid
){
65 if ((animalid
& 0x3FFFFFFFFF) != animalid
) {
66 animalid
&= 0x3FFFFFFFFF;
67 PrintAndLog("Animal ID Truncated to 38bits: %"PRIx64
, animalid
);
69 if ( (countryid
& 0x3ff) != countryid
) {
71 PrintAndLog("Country ID Truncated to 10bits: %03d", countryid
);
75 static uint16_t getFDXchksum (uint64_t raw
){
77 num_to_bytes(raw
, 64, arr
);
78 return crc16_ccitt_kermit(arr
, 8);
81 int getFDXBits(uint64_t national_id
, uint16_t country
, uint8_t isanimal
, uint8_t isextended
, uint32_t extended
, uint8_t *bits
) {
84 uint8_t data
[117] = {0};
87 raw
|= (0x000 & 0x3ff) << 1;
88 raw
|= isextended
<< 14;
89 raw
|= (country
& 0x3ff) << 15;
90 raw
|= (national_id
& 0x3FFFFFFFFF) << 25;
92 uint16_t crc
= getFDXchksum(raw
);
94 // add raw to bitarray
95 num_to_bytebits(raw
, 64, data
);
97 // add crc to bitarray
98 num_to_bytebits(crc
, 16, data
+64);
100 // add extended data to bitarray
101 num_to_bytebits(extended
, 24, data
+64+16);
104 printf("ICE:\n %s\n", sprint_bin(data
, 104) );
105 for (uint8_t i
= 0; i
<104/2; ++i
) {
106 uint8_t tmp
= data
[i
];
107 data
[i
] = data
[104-i
];
110 printf("ICE:\n %s\n", sprint_bin(data
, 104) );
112 // add parity always EVEN (2), every 8bits
114 uint8_t bitlen
= addParity(data
, bits
+11, 104, 9, 2);
116 printf("ICE ERROR PARITY BITLEN 119 != %d\n", bitlen
);
118 // add preamble ten 0x00 and one 0x01
119 memset(bits
, 0x00, 10);
121 printf("%s\n", sprint_bin_break(bits
, 128, 32) );
124 // every 9th bit is 0x01, but we can just fill the rest with 0x01 and overwrite
125 memset(bits, 0x01, 128);
127 // add preamble ten 0x00 and one 0x01
128 memset(bits, 0x00, 10);
131 num_to_bytebitsLSBF(0x00, 7, bits + 66);
132 num_to_bytebitsLSBF(0x00 >> 7, 7, bits + 74);
134 // add animal flag - OK
137 // add extended flag - OK
138 bits[81] = isextended;
140 // add national code 40bits - OK
141 num_to_bytebitsLSBF(national_id >> 0, 8, bits+11);
142 num_to_bytebitsLSBF(national_id >> 8, 8, bits+20);
143 num_to_bytebitsLSBF(national_id >> 16, 8, bits+29);
144 num_to_bytebitsLSBF(national_id >> 24, 8, bits+38);
145 num_to_bytebitsLSBF(national_id >> 32, 6, bits+47);
147 // add country code - OK
148 num_to_bytebitsLSBF(country >> 0, 2, bits+53);
149 num_to_bytebitsLSBF(country >> 2, 8, bits+56);
153 for (uint8_t i=0; i<8; ++i)
154 raw[i] = bytebits_to_byte(bits + 11 + i * 9, 8);
156 uint16_t crc = crc16_ccitt_kermit(raw, 8);
157 num_to_bytebitsLSBF(crc >> 0, 8, bits+83);
158 num_to_bytebitsLSBF(crc >> 8, 8, bits+92);
160 // extended data - OK
161 num_to_bytebitsLSBF( extended >> 0 , 8, bits+101);
162 num_to_bytebitsLSBF( extended >> 8 , 8, bits+110);
163 num_to_bytebitsLSBF( extended >> 16, 8, bits+119);
169 //see ASKDemod for what args are accepted
170 //almost the same demod as cmddata.c/CmdFDXBdemodBI
171 int CmdFdxDemod(const char *Cmd
) {
173 //Differential Biphase / di-phase (inverted biphase)
174 //get binary from ask wave
175 if (!ASKbiphaseDemod("0 32 1 0", FALSE
)) {
176 if (g_debugMode
) PrintAndLog("DEBUG: Error - FDX-B ASKbiphaseDemod failed");
179 size_t size
= DemodBufferLen
;
180 int ans
= FDXBdemodBI(DemodBuffer
, &size
);
184 PrintAndLog("DEBUG: Error - FDX-B too few bits found");
186 PrintAndLog("DEBUG: Error - FDX-B preamble not found");
188 PrintAndLog("DEBUG: Error - FDX-B Size not correct: %d", size
);
190 PrintAndLog("DEBUG: Error - FDX-B ans: %d", ans
);
195 setDemodBuf(DemodBuffer
, 128, ans
);
196 // remove marker bits (1's every 9th digit after preamble) (pType = 2)
197 size
= removeParity(DemodBuffer
, 11, 9, 2, 117);
199 if (g_debugMode
) PrintAndLog("DEBUG: Error - FDX-B error removeParity: %d", size
);
204 uint64_t NationalCode
= ((uint64_t)(bytebits_to_byteLSBF(DemodBuffer
+32,6)) << 32) | bytebits_to_byteLSBF(DemodBuffer
,32);
205 uint16_t countryCode
= bytebits_to_byteLSBF(DemodBuffer
+38,10);
206 uint8_t dataBlockBit
= DemodBuffer
[48];
207 uint32_t reservedCode
= bytebits_to_byteLSBF(DemodBuffer
+49,14);
208 uint8_t animalBit
= DemodBuffer
[63];
209 uint32_t crc16
= bytebits_to_byteLSBF(DemodBuffer
+64,16);
210 uint32_t extended
= bytebits_to_byteLSBF(DemodBuffer
+80,24);
211 uint64_t rawid
= ((uint64_t)
212 //bytebits_to_byte(DemodBuffer, 8) << 96) |
213 //bytebits_to_byte(DemodBuffer,32) << 64) |
214 bytebits_to_byte(DemodBuffer
,32) << 32) |
215 bytebits_to_byte(DemodBuffer
+32, 32);
217 num_to_bytes(rawid
, 8, raw
);
219 uint16_t calcCrc
= crc16_ccitt_kermit(raw
, 8);
221 PrintAndLog("\nFDX-B / ISO 11784/5 Animal Tag ID Found: Raw : %s", sprint_hex(raw
, 8));
222 PrintAndLog("Animal ID %04u-%012llu", countryCode
, NationalCode
);
223 PrintAndLog("National Code %012llu (0x%llX)", NationalCode
, NationalCode
);
224 PrintAndLog("Country Code %04u", countryCode
);
225 PrintAndLog("Reserved/RFU %u (0x04%X)", reservedCode
, reservedCode
);
227 PrintAndLog("Animal Tag %s", animalBit
? "True" : "False");
228 PrintAndLog("Has extended data %s [0x%X]", dataBlockBit
? "True" : "False", extended
);
229 PrintAndLog("CRC-16 0x%04X - 0x%04X [%s]", crc16
, calcCrc
, (calcCrc
== crc16
) ? "Ok" : "Failed");
232 PrintAndLog("Start marker %d; Size %d", ans
, size
);
233 char *bin
= sprint_bin_break(DemodBuffer
, size
, 16);
234 PrintAndLog("DEBUG bin stream:\n%s", bin
);
239 int CmdFdxRead(const char *Cmd
) {
241 getSamples("12000", TRUE
);
242 return CmdFdxDemod(Cmd
);
245 int CmdFdxClone(const char *Cmd
) {
247 uint32_t countryid
= 0;
248 uint64_t animalid
= 0;
249 uint32_t blocks
[5] = {T55x7_MODULATION_DIPHASE
| T55x7_BITRATE_RF_32
| 4<<T55x7_MAXBLOCK_SHIFT
, 0, 0, 0, 0};
252 memset(bs
, 0, sizeof(bits
));
254 char cmdp
= param_getchar(Cmd
, 0);
255 if (strlen(Cmd
) == 0 || cmdp
== 'h' || cmdp
== 'H') return usage_lf_fdx_clone();
257 countryid
= param_get32ex(Cmd
, 0, 0, 10);
258 animalid
= param_get64ex(Cmd
, 1, 0, 10);
261 if (param_getchar(Cmd
, 1) == 'Q' || param_getchar(Cmd
, 1) == 'q') {
262 //t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
263 blocks
[0] = T5555_MODULATION_BIPHASE
| T5555_INVERT_OUTPUT
| 32<<T5555_BITRATE_SHIFT
| 4<<T5555_MAXBLOCK_SHIFT
;
266 verify_values(countryid
, animalid
);
268 // getFDXBits(uint64_t national_id, uint16_t country, uint8_t isanimal, uint8_t isextended, uint32_t extended, uint8_t *bits)
269 if ( !getFDXBits(animalid
, countryid
, 1, 0, 0, bs
)) {
270 PrintAndLog("Error with tag bitstream generation.");
274 // convert from bit stream to block data
275 blocks
[1] = bytebits_to_byte(bs
,32);
276 blocks
[2] = bytebits_to_byte(bs
+32,32);
277 blocks
[3] = bytebits_to_byte(bs
+64,32);
278 blocks
[4] = bytebits_to_byte(bs
+96,32);
280 PrintAndLog("Preparing to clone FDX-B to T55x7 with animal ID: %04u-%"PRIu64
, countryid
, animalid
);
281 PrintAndLog("Blk | Data ");
282 PrintAndLog("----+------------");
283 PrintAndLog(" 00 | 0x%08x", blocks
[0]);
284 PrintAndLog(" 01 | 0x%08x", blocks
[1]);
285 PrintAndLog(" 02 | 0x%08x", blocks
[2]);
286 PrintAndLog(" 03 | 0x%08x", blocks
[3]);
287 PrintAndLog(" 04 | 0x%08x", blocks
[4]);
290 UsbCommand c
= {CMD_T55XX_WRITE_BLOCK
, {0,0,0}};
292 for (int i
= 4; i
>= 0; --i
) {
293 c
.arg
[0] = blocks
[i
];
295 clearCommandBuffer();
297 if (!WaitForResponseTimeout(CMD_ACK
, &resp
, 1000)){
298 PrintAndLog("Error occurred, device did not respond during write operation.");
305 int CmdFdxSim(const char *Cmd
) {
306 uint32_t countryid
= 0;
307 uint64_t animalid
= 0;
309 char cmdp
= param_getchar(Cmd
, 0);
310 if (strlen(Cmd
) == 0 || cmdp
== 'h' || cmdp
== 'H') return usage_lf_fdx_sim();
312 countryid
= param_get32ex(Cmd
, 0, 0, 10);
313 animalid
= param_get64ex(Cmd
, 1, 0, 10);
315 verify_values(countryid
, animalid
);
317 uint8_t clk
= 32, encoding
= 2, separator
= 0, invert
= 1;
320 arg1
= clk
<< 8 | encoding
;
321 arg2
= invert
<< 8 | separator
;
323 PrintAndLog("Simulating FDX-B animal ID: %04u-%"PRIu64
, countryid
, animalid
);
325 UsbCommand c
= {CMD_ASK_SIM_TAG
, {arg1
, arg2
, size
}};
327 //getFDXBits(uint64_t national_id, uint16_t country, uint8_t isanimal, uint8_t isextended, uint32_t extended, uint8_t *bits)
328 getFDXBits(animalid
, countryid
, 1, 0, 0, c
.d
.asBytes
);
329 clearCommandBuffer();
334 static command_t CommandTable
[] = {
335 {"help", CmdHelp
, 1, "This help"},
336 {"demod", CmdFdxDemod
,1, "Attempt extract tag data from graphbuf"},
337 {"read", CmdFdxRead
, 0, "Attempt to read and extract tag data"},
338 {"clone", CmdFdxClone
,0, "Clone animal ID tag to T55x7"},
339 {"sim", CmdFdxSim
, 0, "Animal ID tag simulator"},
340 {NULL
, NULL
, 0, NULL
}
343 int CmdLFFdx(const char *Cmd
) {
344 clearCommandBuffer();
345 CmdsParse(CommandTable
, Cmd
);
349 int CmdHelp(const char *Cmd
) {
350 CmdsHelp(CommandTable
);