X-Git-Url: http://cvs.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/367996567bb9f22c1e53c1e8913e57a9570eb6b7..371535d566ef790b75c6a8e1d412c97345eb3067:/client/cmdhflegic.c diff --git a/client/cmdhflegic.c b/client/cmdhflegic.c index 08e283b5..3cc6c406 100644 --- a/client/cmdhflegic.c +++ b/client/cmdhflegic.c @@ -149,7 +149,16 @@ int usage_legic_esave(void){ PrintAndLog(" hf legic esave 2 myfile"); return 0; } - +int usage_legic_wipe(void){ + PrintAndLog("Fills a legic tag memory with zeros. From byte7 and to the end."); + PrintAndLog(" Usage: hf legic wipe [h]"); + PrintAndLog("Options:"); + PrintAndLog(" h : this help"); + PrintAndLog(""); + PrintAndLog("Samples:"); + PrintAndLog(" hf legic wipe"); + return 0; +} /* * Output BigBuf and deobfuscate LEGIC RF tag data. * This is based on information given in the talk held @@ -506,8 +515,8 @@ int CmdLegicRdmem(const char *Cmd) { return 1; } - PrintAndLog("\n ## | Data"); - PrintAndLog("-----+-----"); + PrintAndLog("\n ## | 0 1 2 3 4 5 6 7 8 9 A B C D E F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F"); + PrintAndLog("-----+------------------------------------------------------------------------------------------------"); print_hex_break( data, readlen, 32); free(data); return 0; @@ -551,11 +560,19 @@ int CmdLegicRfWrite(const char *Cmd) { errors = true; break; } + + // limit number of bytes to write. This is not a 'restore' command. + if ( (len>>1) > 100 ){ + PrintAndLog("Max bound on 100bytes to write a one time."); + PrintAndLog("Use the 'hf legic restore' command if you want to write the whole tag at once"); + errors = true; + } // it's possible for user to accidentally enter "b" parameter // more than once - we have to clean previous malloc if (data) free(data); + data = malloc(len >> 1); if ( data == NULL ) { PrintAndLog("Can't allocate memory. exiting"); @@ -604,27 +621,41 @@ int CmdLegicRfWrite(const char *Cmd) { legic_print_type(card.cardsize, 0); // OUT-OF-BOUNDS checks - // UID 4 bytes can't be written to. - if ( offset < 4 ) { - PrintAndLog("Out-of-bounds, UID 4bytes can't be written to. Offset = %d", offset); + // UID 4+1 bytes can't be written to. + if ( offset < 5 ) { + PrintAndLog("Out-of-bounds, bytes 0-1-2-3-4 can't be written to. Offset = %d", offset); return -2; } - if ( len + offset + 4 >= card.cardsize ) { - PrintAndLog("Out-of-bounds, Cardsize = %d, [offset+len = %d ]", card.cardsize, len + offset + 4); + if ( len + offset >= card.cardsize ) { + PrintAndLog("Out-of-bounds, Cardsize = %d, [offset+len = %d ]", card.cardsize, len + offset); return -2; } + if (offset == 5 || offset == 6) { + PrintAndLog("############# DANGER ################"); + PrintAndLog("# changing the DCF is irreversible #"); + PrintAndLog("#####################################"); + char *answer = NULL; + answer = readline("do you really want to continue? y(es) n(o) : "); + bool overwrite = (answer[0] == 'y' || answer[0] == 'Y'); + if (!overwrite){ + PrintAndLog("command cancelled"); + return 0; + } + } + legic_chk_iv(&IV); PrintAndLog("Writing to tag"); - UsbCommand c = {CMD_WRITER_LEGIC_RF, {offset, len, IV}}; - memcpy(c.d.asBytes, data, len); - - clearCommandBuffer(); - SendCommand(&c); + + UsbCommand c = {CMD_WRITER_LEGIC_RF, {offset, len, IV}}; + memcpy(c.d.asBytes, data, len); UsbCommand resp; - if (!WaitForResponseTimeout(CMD_ACK, &resp, 4000)) { + clearCommandBuffer(); + SendCommand(&c); + + if (!WaitForResponseTimeout(CMD_ACK, &resp, 2000)) { PrintAndLog("command execution time out"); return 1; } @@ -633,20 +664,10 @@ int CmdLegicRfWrite(const char *Cmd) { PrintAndLog("failed writing tag"); return 1; } - + return 0; } -/* - PrintAndLog("############# DANGER !! #############"); - PrintAndLog("# changing the DCF is irreversible #"); - PrintAndLog("#####################################"); - PrintAndLog("do youe really want to continue? y(es) n(o)"); - // if (scanf(" %c", &answer) > 0 && (answer == 'y' || answer == 'Y')) { - // return 0; - // } -*/ - int CmdLegicCalcCrc(const char *Cmd){ uint8_t *data = NULL; @@ -922,7 +943,7 @@ int CmdLegicRestore(const char *Cmd){ char filename[FILE_PATH_SIZE] = {0x00}; char *fnameptr = filename; size_t fileNlen = 0; - bool errors = false; + bool errors = true; uint16_t numofbytes; uint8_t cmdp = 0; @@ -938,17 +959,20 @@ int CmdLegicRestore(const char *Cmd){ case 'I': fileNlen = param_getstr(Cmd, cmdp+1, filename); if (!fileNlen) - errors = true; + errors = true; + else + errors = false; + if (fileNlen > FILE_PATH_SIZE-5) fileNlen = FILE_PATH_SIZE-5; - cmdp += 2; + cmdp += 2; break; default: PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp)); errors = true; break; } - if(errors) break; + if (errors) break; } //Validations @@ -987,15 +1011,11 @@ int CmdLegicRestore(const char *Cmd){ fseek(f, 0, SEEK_SET); // seek back to beginning of file if ( filesize != numofbytes) { - PrintAndLog("Fail, Filesize and cardsize is not equal. [%u != %u]", filesize, numofbytes); + PrintAndLog("Fail, filesize and cardsize is not equal. [%u != %u]", filesize, numofbytes); free(data); fclose(f); return 4; } - - - PrintAndLog("Reading binary file..."); - // load file size_t bytes_read = fread(data, 1, numofbytes, f); @@ -1007,14 +1027,37 @@ int CmdLegicRestore(const char *Cmd){ } fclose(f); - PrintAndLog("Restoring %s to card", filename); - - //loop writing :) + PrintAndLog("Restoring to card"); - //endloop + // transfer to device + size_t len = 0; + UsbCommand c = {CMD_WRITER_LEGIC_RF, {0, 0, 0x55}}; + UsbCommand resp; + for(size_t i = 7; i < numofbytes; i += USB_CMD_DATA_SIZE) { + + len = MIN((numofbytes - i), USB_CMD_DATA_SIZE); + c.arg[0] = i; // offset + c.arg[1] = len; // number of bytes + memcpy(c.d.asBytes, data+i, len); + clearCommandBuffer(); + SendCommand(&c); + + if (!WaitForResponseTimeout(CMD_ACK, &resp, 4000)) { + PrintAndLog("command execution time out"); + free(data); + return 1; + } + uint8_t isOK = resp.arg[0] & 0xFF; + if ( !isOK ) { + PrintAndLog("failed writing tag [msg = %u]", resp.arg[1] & 0xFF); + free(data); + return 1; + } + PrintAndLog("Wrote chunk [offset %d | len %d | total %d", i, len, i+len); + } free(data); - PrintAndLog("\nLoaded %d bytes from file: %s to emulator memory", numofbytes, filename); + PrintAndLog("\nWrote %d bytes to card from file %s", numofbytes, filename); return 0; } @@ -1139,6 +1182,61 @@ int CmdLegicESave(const char *Cmd) { return 0; } +int CmdLegicWipe(const char *Cmd){ + + char cmdp = param_getchar(Cmd, 0); + + if ( cmdp == 'h' || cmdp == 'H') return usage_legic_wipe(); + + // tagtype + legic_card_select_t card; + if (legic_get_type(&card)) { + PrintAndLog("Failed to identify tagtype"); + return 1; + } + + // set up buffer + uint8_t *data = malloc(card.cardsize); + if (!data) { + PrintAndLog("Fail, cannot allocate memory"); + return 2; + } + memset(data, 0, card.cardsize); + + legic_print_type(card.cardsize, 0); + + printf("Erasing"); + + // transfer to device + size_t len = 0; + UsbCommand c = {CMD_WRITER_LEGIC_RF, {0, 0, 0x55}}; + UsbCommand resp; + for(size_t i = 7; i < card.cardsize; i += USB_CMD_DATA_SIZE) { + + printf("."); + len = MIN((card.cardsize - i), USB_CMD_DATA_SIZE); + c.arg[0] = i; // offset + c.arg[1] = len; // number of bytes + memcpy(c.d.asBytes, data+i, len); + clearCommandBuffer(); + SendCommand(&c); + + if (!WaitForResponseTimeout(CMD_ACK, &resp, 4000)) { + PrintAndLog("command execution time out"); + free(data); + return 3; + } + uint8_t isOK = resp.arg[0] & 0xFF; + if ( !isOK ) { + PrintAndLog("failed writing tag [msg = %u]", resp.arg[1] & 0xFF); + free(data); + return 4; + } + } + printf("ok\n"); + return 0; +} + int CmdLegicList(const char *Cmd) { CmdHFList("legic"); return 0; @@ -1157,6 +1255,7 @@ static command_t CommandTable[] = { {"eload", CmdLegicELoad, 1, "Load binary dump to emulator memory"}, {"esave", CmdLegicESave, 1, "Save emulator memory to binary file"}, {"list", CmdLegicList, 1, "[Deprecated] List LEGIC history"}, + {"wipe", CmdLegicWipe, 1, "Wipe a LEGIC Prime tag"}, {NULL, NULL, 0, NULL} };