]>
cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfguard.c
ddfd29637da575fdbd634965ac7bd161f412fd22
1 //-----------------------------------------------------------------------------
3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
4 // at your option, any later version. See the LICENSE.txt file for the text of
6 //-----------------------------------------------------------------------------
7 // Low frequency Farpoint / Pyramid tag commands
8 //-----------------------------------------------------------------------------
10 #include "cmdlfguard.h"
11 static int CmdHelp(const char *Cmd
);
13 int usage_lf_guard_clone(void){
14 PrintAndLog("clone a Guardall tag to a T55x7 tag.");
15 PrintAndLog("The facility-code is 8-bit and the card number is 16-bit. Larger values are truncated. ");
16 PrintAndLog("Currently work only on 26bit");
18 PrintAndLog("Usage: lf guard clone <format> <Facility-Code> <Card-Number>");
19 PrintAndLog("Options :");
20 PrintAndLog(" <format> : format length 26|32|36|40");
21 PrintAndLog(" <Facility-Code> : 8-bit value facility code");
22 PrintAndLog(" <Card Number> : 16-bit value card number");
24 PrintAndLog("Sample : lf guard clone 123 11223");
28 int usage_lf_guard_sim(void) {
29 PrintAndLog("Enables simulation of Guardall card with specified card number.");
30 PrintAndLog("Simulation runs until the button is pressed or another USB command is issued.");
31 PrintAndLog("The facility-code is 8-bit and the card number is 16-bit. Larger values are truncated.");
32 PrintAndLog("Currently work only on 26bit");
34 PrintAndLog("Usage: lf guard sim <format> <Card-Number>");
35 PrintAndLog("Options :");
36 PrintAndLog(" <format> : format length 26|32|36|40");
37 PrintAndLog(" <Facility-Code> : 8-bit value facility code");
38 PrintAndLog(" <Card Number> : 16-bit value card number");
40 PrintAndLog("Sample : lf guard sim 123 11223");
45 int GetGuardBits(uint8_t fmtlen
, uint32_t fc
, uint32_t cn
, uint8_t *guardBits
) {
47 uint8_t xorKey
= 0x66;
51 memset(pre
, 0x00, sizeof(pre
));
52 memset(rawbytes
, 0x00, sizeof(rawbytes
));
54 // add format length (decimal)
57 rawbytes
[1] = (32 << 2);
62 // FC = ((ByteStream[3] & 0x7F)<<7) | (ByteStream[4]>>1);
63 // Card = ((ByteStream[4]&1)<<19) | (ByteStream[5]<<11) | (ByteStream[6]<<3) | (ByteStream[7]>>5);
64 rawbytes
[1] = (36 << 2);
65 // Get 26 wiegand from FacilityCode, CardNumber
67 memset(wiegand
, 0x00, sizeof(wiegand
));
68 num_to_bytebits(fc
, 8, wiegand
);
69 num_to_bytebits(cn
, 26, wiegand
+8);
71 // add wiegand parity bits (dest, source, len)
72 wiegand_add_parity(pre
, wiegand
, 34);
76 rawbytes
[1] = (40 << 2);
81 rawbytes
[1] = (26 << 2);
82 // Get 26 wiegand from FacilityCode, CardNumber
84 memset(wiegand
, 0x00, sizeof(wiegand
));
85 num_to_bytebits(fc
, 8, wiegand
);
86 num_to_bytebits(cn
, 16, wiegand
+8);
88 // add wiegand parity bits (dest, source, len)
89 wiegand_add_parity(pre
, wiegand
, 24);
93 // 2bit checksum, unknown today,
94 // these two bits are the last ones of rawbyte[1], hence the LSHIFT above.
103 // add wiegand to rawbytes
104 for (i
= 0; i
< 4; ++i
)
105 rawbytes
[i
+4] = bytebits_to_byte( pre
+ (i
*8), 8);
107 if (g_debugMode
) printf(" WIE | %s\n", sprint_hex(rawbytes
, sizeof(rawbytes
)));
110 // XOR (only works on wiegand stuff)
111 for (i
= 1; i
< 12; ++i
)
112 rawbytes
[i
] ^= xorKey
;
114 if (g_debugMode
) printf(" XOR | %s \n", sprint_hex(rawbytes
, sizeof(rawbytes
)));
116 // convert rawbytes to bits in pre
117 for (i
= 0; i
< 12; ++i
)
118 num_to_bytebitsLSBF( rawbytes
[i
], 8, pre
+ (i
*8));
120 if (g_debugMode
) printf("\n Raw | %s \n", sprint_hex(rawbytes
, sizeof(rawbytes
)));
121 if (g_debugMode
) printf(" Raw | %s\n", sprint_bin(pre
, 64) );
123 // add spacer bit 0 every 4 bits, starting with index 0,
124 // 12 bytes, 24 nibbles. 24+1 extra bites. 3bytes. ie 9bytes | 1byte xorkey, 8bytes rawdata (64bits, should be enough for a 40bit wiegand)
125 addParity(pre
, guardBits
+6, 64, 5, 3);
135 if (g_debugMode
) printf(" FIN | %s\n", sprint_bin(guardBits
, 96) );
139 int CmdGuardRead(const char *Cmd
) {
141 getSamples("12000", TRUE
);
142 return CmdG_Prox_II_Demod("");
145 int CmdGuardClone(const char *Cmd
) {
147 char cmdp
= param_getchar(Cmd
, 0);
148 if (strlen(Cmd
) == 0 || cmdp
== 'h' || cmdp
== 'H') return usage_lf_guard_clone();
150 uint32_t facilitycode
= 0, cardnumber
= 0, fc
= 0, cn
= 0, fmtlen
= 0;
153 memset(bs
, 0x00, sizeof(bs
));
155 //GuardProxII - compat mode, ASK/Biphase, data rate 64, 3 data blocks
156 uint32_t blocks
[5] = {T55x7_MODULATION_BIPHASE
| T55x7_BITRATE_RF_64
| 3 << T55x7_MAXBLOCK_SHIFT
, 0, 0, 0, 0};
158 if (param_getchar(Cmd
, 3) == 'Q' || param_getchar(Cmd
, 3) == 'q')
159 //t5555 (Q5) BITRATE = (RF-2)/2 (iceman)
160 blocks
[0] = T5555_MODULATION_FSK2
| ((50-2)>>1) << T5555_BITRATE_SHIFT
| 3 << T5555_MAXBLOCK_SHIFT
;
162 if (sscanf(Cmd
, "%u %u %u", &fmtlen
, &fc
, &cn
) != 2) return usage_lf_guard_clone();
165 facilitycode
= (fc
& 0x000000FF);
166 cardnumber
= (cn
& 0x0000FFFF);
168 if ( !GetGuardBits(fmtlen
, facilitycode
, cardnumber
, bs
)) {
169 PrintAndLog("Error with tag bitstream generation.");
173 blocks
[1] = bytebits_to_byte(bs
,32);
174 blocks
[2] = bytebits_to_byte(bs
+32,32);
175 blocks
[3] = bytebits_to_byte(bs
+64,32);
177 PrintAndLog("Preparing to clone Guardall to T55x7 with Facility Code: %u, Card Number: %u", facilitycode
, cardnumber
);
178 PrintAndLog("Blk | Data ");
179 PrintAndLog("----+------------");
180 for ( i
= 0; i
<4; ++i
)
181 PrintAndLog(" %02d | 0x%08x", i
, blocks
[i
]);
184 UsbCommand c
= {CMD_T55XX_WRITE_BLOCK
, {0,0,0}};
186 for ( i
= 0; i
<4; ++i
) {
187 c
.arg
[0] = blocks
[i
];
189 clearCommandBuffer();
191 if (!WaitForResponseTimeout(CMD_ACK
, &resp
, T55XX_WRITE_TIMEOUT
)){
192 PrintAndLog("Error occurred, device did not respond during write operation.");
199 int CmdGuardSim(const char *Cmd
) {
201 char cmdp
= param_getchar(Cmd
, 0);
202 if (strlen(Cmd
) == 0 || cmdp
== 'h' || cmdp
== 'H') return usage_lf_guard_sim();
204 uint32_t facilitycode
= 0, cardnumber
= 0, fc
= 0, cn
= 0, fmtlen
= 0;
205 uint8_t clock
= 64, encoding
= 2, separator
= 0, invert
= 0;
208 memset(bs
, 0x00, sizeof(bs
));
210 if (sscanf(Cmd
, "%u %u %u", &fmtlen
, &fc
, &cn
) != 2) return usage_lf_guard_sim();
213 facilitycode
= (fc
& 0x000000FF);
214 cardnumber
= (cn
& 0x0000FFFF);
216 if ( !GetGuardBits(fmtlen
, facilitycode
, cardnumber
, bs
)) {
217 PrintAndLog("Error with tag bitstream generation.");
221 PrintAndLog("Simulating Guardall - Facility Code: %u, CardNumber: %u", facilitycode
, cardnumber
);
223 // Guard uses: clk: 64, invert: 0, encoding: 2 (ASK Biphase)
225 arg1
= (clock
<< 8) | encoding
;
226 arg2
= (invert
<< 8) | separator
;
228 uint8_t rawbytes
[12];
229 size_t size
= sizeof(rawbytes
);
230 for (uint8_t i
=0; i
< size
; ++i
){
231 rawbytes
[i
] = bytebits_to_byte( bs
+ (i
*8), 8);
234 UsbCommand c
= {CMD_ASK_SIM_TAG
, {arg1
, arg2
, size
}};
235 memcpy(c
.d
.asBytes
, rawbytes
, size
);
236 clearCommandBuffer();
241 static command_t CommandTable
[] = {
242 {"help", CmdHelp
, 1, "This help"},
243 {"read", CmdGuardRead
, 0, "Attempt to read and extract tag data"},
244 {"clone", CmdGuardClone
, 0, "<Facility-Code> <Card Number> clone Guardall tag"},
245 {"sim", CmdGuardSim
, 0, "<Facility-Code> <Card Number> simulate Guardall tag"},
246 {NULL
, NULL
, 0, NULL
}
249 int CmdLFGuard(const char *Cmd
) {
250 clearCommandBuffer();
251 CmdsParse(CommandTable
, Cmd
);
255 int CmdHelp(const char *Cmd
) {
256 CmdsHelp(CommandTable
);