]>
cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfhid.c
d4fd1522316cafbef0bf58f4edac5b62b9128bc5
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // Low frequency HID commands
9 //-----------------------------------------------------------------------------
13 static int CmdHelp(const char *Cmd
);
15 int usage_lf_hid_wiegand(void){
16 PrintAndLog("This command converts facility code/card number to Wiegand code");
17 PrintAndLog("Usage: lf hid wiegand [h] [OEM] [FC] [CN]");
19 PrintAndLog("Options:");
20 PrintAndLog(" h - This help");
21 PrintAndLog(" OEM - OEM number / site code");
22 PrintAndLog(" FC - facility code");
23 PrintAndLog(" CN - card number");
24 PrintAndLog("Examples:");
25 PrintAndLog(" lf hid wiegand 0 101 2001");
28 int usage_lf_hid_sim(void){
29 PrintAndLog("HID Tag simulator");
31 PrintAndLog("Usage: lf hid sim [h] [ID]");
32 PrintAndLog("Options:");
33 PrintAndLog(" h - This help");
34 PrintAndLog(" ID - HID id");
35 PrintAndLog("Examples:");
36 PrintAndLog(" lf hid sim 224");
39 int usage_lf_hid_clone(void){
40 PrintAndLog("Clone HID to T55x7. Tag must be on antenna. ");
42 PrintAndLog("Usage: lf hid clone [h] [ID] <L>");
43 PrintAndLog("Options:");
44 PrintAndLog(" h - This help");
45 PrintAndLog(" ID - HID id");
46 PrintAndLog(" L - 84bit ID");
47 PrintAndLog("Examples:");
48 PrintAndLog(" lf hid clone 224");
49 PrintAndLog(" lf hid clone 224 L");
52 int usage_lf_hid_brute(void){
53 PrintAndLog("Enables bruteforce of HID readers with specified facility code.");
54 PrintAndLog("This is a attack against reader. if cardnumber is given, it starts with it and goes up / down one step");
55 PrintAndLog("if cardnumber is not given, it starts with 1 and goes up to 65535");
57 PrintAndLog("Usage: lf hid brute [h] a <format> f <facility-code> c <cardnumber> d <delay>");
58 PrintAndLog("Options :");
59 PrintAndLog(" h : This help");
60 PrintAndLog(" a <format> : 26|33|34|35|37|40|44|84");
61 PrintAndLog(" f <facility-code> : 8-bit value HID facility code");
62 PrintAndLog(" c <cardnumber> : (optional) cardnumber to start with, max 65535");
63 PrintAndLog(" d <delay> : delay betweens attempts in ms. Default 1000ms");
65 PrintAndLog("Samples:");
66 PrintAndLog(" lf hid brute a 26 f 224");
67 PrintAndLog(" lf hid brute a 26 f 21 d 2000");
68 PrintAndLog(" lf hid brute a 26 f 21 c 200 d 2000");
72 static int sendPing(void){
73 UsbCommand ping
= {CMD_PING
, {1, 2, 3}};
79 if (WaitForResponseTimeout(CMD_ACK
, &resp
, 1000))
83 static bool sendTry(uint8_t fmtlen
, uint32_t fc
, uint32_t cn
, uint32_t delay
, uint8_t *bs
){
85 PrintAndLog("Trying FC: %u; CN: %u", fc
, cn
);
87 calcWiegand( fmtlen
, fc
, cn
, bs
);
89 uint64_t arg1
= bytebits_to_byte(bs
,32);
90 uint64_t arg2
= bytebits_to_byte(bs
+32,32);
91 UsbCommand c
= {CMD_HID_SIM_TAG
, {arg1
, arg2
, 0}};
99 int CmdHIDDemodFSK(const char *Cmd
) {
100 int findone
= ( Cmd
[0] == '1' ) ? 1 : 0;
101 UsbCommand c
= {CMD_HID_DEMOD_FSK
, {findone
, 0 , 0}};
102 clearCommandBuffer();
107 int CmdHIDSim(const char *Cmd
) {
108 unsigned int hi
= 0, lo
= 0;
111 uint8_t ctmp
= param_getchar(Cmd
, 0);
112 if ( strlen(Cmd
) == 0 || ctmp
== 'H' || ctmp
== 'h' ) return usage_lf_hid_sim();
114 while (sscanf(&Cmd
[i
++], "%1x", &n
) == 1) {
115 hi
= (hi
<< 4) | (lo
>> 28);
116 lo
= (lo
<< 4) | (n
& 0xf);
119 PrintAndLog("Emulating tag with ID %x%16x", hi
, lo
);
120 PrintAndLog("Press pm3-button to abort simulation");
122 UsbCommand c
= {CMD_HID_SIM_TAG
, {hi
, lo
, 0}};
123 clearCommandBuffer();
128 int CmdHIDClone(const char *Cmd
) {
130 uint32_t hi2
= 0, hi
= 0, lo
= 0;
134 uint8_t ctmp
= param_getchar(Cmd
, 0);
135 if ( strlen(Cmd
) == 0 || ctmp
== 'H' || ctmp
== 'h' ) return usage_lf_hid_clone();
137 if (strchr(Cmd
,'l') != 0) {
138 while (sscanf(&Cmd
[i
++], "%1x", &n
) == 1) {
139 hi2
= (hi2
<< 4) | (hi
>> 28);
140 hi
= (hi
<< 4) | (lo
>> 28);
141 lo
= (lo
<< 4) | (n
& 0xf);
144 PrintAndLog("Cloning tag with long ID %x%08x%08x", hi2
, hi
, lo
);
148 while (sscanf(&Cmd
[i
++], "%1x", &n
) == 1) {
149 hi
= (hi
<< 4) | (lo
>> 28);
150 lo
= (lo
<< 4) | (n
& 0xf);
153 PrintAndLog("Cloning tag with ID %x%08x", hi
, lo
);
159 c
.cmd
= CMD_HID_CLONE_TAG
;
164 clearCommandBuffer();
168 // struct to handle wiegand
172 uint8_t FacilityCode
;
178 // static void addHIDMarker(uint8_t fmtlen, uint8_t *out) {
181 //static void getParity26(uint32_t *hi, uint32_t *lo){
182 // uint32_t result = 0;
185 // for (i = 24;i >= 13;i--)
186 // result ^= (*lo >> i) & 1;
187 // // even parity 26th bit
188 // *lo |= result << 25;
192 // for (i = 12;i >= 1;i--)
193 // result ^= (*lo >> i) & 1;
197 // static void getParity33(uint32_t *hi, uint32_t *lo){
200 // static void getParity34(uint32_t *hi, uint32_t *lo){
201 // uint32_t result = 0;
205 // for (i = 7;i >= 0;i--)
206 // result ^= (*hi >> i) & i;
207 // for (i = 31;i >= 24;i--)
208 // result ^= (*lo >> i) & 1;
210 // *hi |= result << 2;
214 // for (i = 23;i >= 1;i--)
215 // result ^= (*lo >> i) & 1;
219 // static void getParity35(uint32_t *hi, uint32_t *lo){
221 // static void getParity37S(uint32_t *hi,uint32_t *lo){
222 // uint32_t result = 0;
226 // for (i = 4; i >= 0; i--)
227 // result ^= (*hi >> i) & 1;
229 // for (i = 31; i >= 20; i--)
230 // result ^= (*lo >> i) & 1;
236 // for (i = 19; i >= 1; i--)
237 // result ^= (*lo >> i) & 1;
241 // static void getParity37H(uint32_t *hi, uint32_t *lo){
242 // uint32_t result = 0;
246 // for (i = 4;i >= 0;i--)
247 // result ^= (*hi >> i) & 1;
248 // for (i = 31;i >= 20;i--)
249 // result ^= (*lo >> i) & 1;
250 // *hi |= result << 4;
254 // for (i = 19;i >= 1;i--)
255 // result ^= (*lo >> i) & 1;
259 //static void calc26(uint16_t fc, uint32_t cardno, uint32_t *hi, uint32_t *lo){
260 void calc26(uint16_t fc
, uint32_t cardno
, uint8_t *out
){
263 num_to_bytebits(fc
, 8, wiegand
);
264 num_to_bytebits(cardno
, 16, wiegand
+8);
265 wiegand_add_parity(out
, wiegand
, sizeof(wiegand
) );
267 // *out |= (1 << 26); // why this?
268 // *out |= (1 << 37); // bit format for hid?
270 // static void calc33(uint16_t fc, uint32_t cardno, uint32_t *hi, uint32_t *lo){
273 // static void calc34(uint16_t fc, uint32_t cardno, uint32_t *hi, uint32_t *lo){
274 // // put card number first bit 1 .. 20 //
275 // *lo = ((cardno & 0X000F7FFF) << 1) | ((fc & 0XFFFF) << 17);
276 // // set bit format for less than 37 bit format
277 // *hi = (1 << 5) | (fc >> 15);
279 // static void calc35(uint16_t fc, uint32_t cardno, uint32_t *hi, uint32_t *lo){
280 // *lo = ((cardno & 0xFFFFF) << 1) | fc << 21;
281 // *hi = (1 << 5) | ((fc >> 11) & 1);
283 // static void calc37S(uint16_t fc, uint32_t cardno, uint32_t *hi, uint32_t *lo){
284 // // FC 2 - 17 - 16 bit
285 // // cardno 18 - 36 - 19 bit
287 // // Odd P37 19 - 36
290 // *lo = ((fc << 20) | (cardno & 0x7FFFF) << 1);
293 // static void calc37H(uint64_t cardno, uint32_t *hi, uint32_t *lo){
295 // // cardno 1-35 34 bits
296 // // Even Parity 0th bit 1-18
297 // // Odd Parity 36th bit 19-35
298 // cardno = (cardno & 0x00000003FFFFFFFF);
299 // *lo = (cardno << 1);
300 // *hi = (cardno >> 31);
302 // static void calc40(uint64_t cardno, uint32_t *hi, uint32_t *lo){
303 // cardno = (cardno & 0xFFFFFFFFFF);
304 // *lo = ((cardno & 0xFFFFFFFF) << 1 );
305 // *hi = (cardno >> 31);
308 void calcWiegand(uint8_t fmtlen
, uint16_t fc
, uint64_t cardno
, uint8_t *bits
){
310 // uint32_t hi = 0, lo = 0;
311 // uint32_t cn32 = (cardno & 0xFFFFFFFF);
312 // switch ( fmtlen ) {
314 // calc26(fc, cn32, bits);
315 // addHIDFormatMarker(fmtlen, bits);
319 // // calc33(fc, cn32, hi, lo);
320 // // getParity33(hi, lo);
324 // calc34(fc, cn32, hi, lo);
325 // getParity34(hi, lo);
329 // calc35(fc, cn32, hi, lo);
330 // getParity35(hi, lo);
334 // calc37S(fc, cn32, hi, lo);
335 // getParity37S(hi, lo);
339 // calc37H(cn32, hi, lo);
340 // getParity37H(hi, lo);
343 // case 40 : calc40(cardno, hi, lo); break;
344 // case 44 : { break; }
345 // case 84 : { break; }
350 int CmdHIDWiegand(const char *Cmd
) {
351 uint32_t oem
= 0, fc
= 0;
352 uint64_t cardnum
= 0;
354 uint32_t blocks
[2] = {0,0};
355 uint32_t wiegand
[2] = {0,0};
359 memset(bs
, 0, sizeof(bits
));
361 uint8_t ctmp
= param_getchar(Cmd
, 0);
362 if ( strlen(Cmd
) == 0 || strlen(Cmd
) < 3 || ctmp
== 'H' || ctmp
== 'h' ) return usage_lf_hid_wiegand();
364 oem
= param_get8(Cmd
, 0);
365 fc
= param_get32ex(Cmd
, 1, 0, 10);
366 cardnum
= param_get64ex(Cmd
, 2, 0, 10);
369 uint8_t ftmlen
[] = {26,33,34,35,37,38,40};
371 PrintAndLog("HID | OEM | FC | CN | Wiegand | HID Formatted");
372 PrintAndLog("----+-----+-----+-------+-----------+--------------------");
373 for (uint8_t i
= 0; i
< sizeof(ftmlen
); i
++){
374 calcWiegand( ftmlen
[i
], fc
, cardnum
, bs
);
375 blocks
[0] = bytebits_to_byte(bs
,32);
376 blocks
[1] = bytebits_to_byte(bs
+32,32);
377 PrintAndLog(" %d | %d | %d | %llu | %08X%08X | %08X%08X ",
388 PrintAndLog("----+-----+-----+-------+-----------+--------------------");
392 int CmdHIDBrute(const char *Cmd
){
395 uint32_t fc
= 0, cn
= 0, delay
= 1000;
399 memset(bs
, 0, sizeof(bits
));
402 while(param_getchar(Cmd
, cmdp
) != 0x00 && !errors
) {
403 switch(param_getchar(Cmd
, cmdp
)) {
406 return usage_lf_hid_brute();
409 fc
= param_get32ex(Cmd
,cmdp
+1, 0, 10);
416 // delay between attemps, defaults to 1000ms.
417 delay
= param_get32ex(Cmd
, cmdp
+1, 1000, 10);
422 cn
= param_get32ex(Cmd
, cmdp
+1, 0, 10);
423 // truncate cardnumber.
429 fmtlen
= param_get8(Cmd
, cmdp
+1);
431 bool is_ftm_ok
= FALSE
;
432 uint8_t ftms
[] = {26,33,34,35,37};
433 for ( uint8_t i
= 0; i
< sizeof(ftms
); i
++){
434 if ( ftms
[i
] == fmtlen
) {
442 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
447 if ( fc
== 0 ) errors
= true;
448 if ( errors
) return usage_lf_hid_brute();
450 PrintAndLog("Brute-forcing HID reader");
451 PrintAndLog("Press pm3-button to abort simulation or run another command");
459 printf("Device offline\n");
464 PrintAndLog("aborted via keyboard!");
470 if ( !sendTry(fmtlen
, fc
, up
++, delay
, bs
)) return 1;
472 // Do one down (if cardnumber is given)
475 if ( !sendTry(fmtlen
, fc
, --down
, delay
, bs
)) return 1;
480 static command_t CommandTable
[] = {
481 {"help", CmdHelp
, 1, "This help"},
482 {"fskdemod",CmdHIDDemodFSK
, 0, "Realtime HID FSK demodulator"},
483 {"sim", CmdHIDSim
, 0, "HID tag simulator"},
484 {"clone", CmdHIDClone
, 0, "Clone HID to T55x7"},
485 {"wiegand", CmdHIDWiegand
, 1, "Convert facility code/card number to Wiegand code"},
486 {"brute", CmdHIDBrute
, 0, "Bruteforce card number against reader"},
487 {NULL
, NULL
, 0, NULL
}
490 int CmdLFHID(const char *Cmd
) {
491 clearCommandBuffer();
492 CmdsParse(CommandTable
, Cmd
);
496 int CmdHelp(const char *Cmd
) {
497 CmdsHelp(CommandTable
);