From c3caf0409cbc89f3cdda533c0860bfc813f8817b Mon Sep 17 00:00:00 2001 From: marshmellow42 Date: Wed, 29 Mar 2017 00:37:16 -0400 Subject: [PATCH 1/1] add lf securakey still unknown - checksum and how FC relates to printed FC/Code also removed noralsy extra ST check (i was tired...) --- client/Makefile | 7 +- client/cmdlf.c | 8 +++ client/cmdlfnoralsy.c | 10 +-- client/cmdlfsecurakey.c | 143 ++++++++++++++++++++++++++++++++++++++++ client/cmdlfsecurakey.h | 19 ++++++ 5 files changed, 177 insertions(+), 10 deletions(-) create mode 100644 client/cmdlfsecurakey.c create mode 100644 client/cmdlfsecurakey.h diff --git a/client/Makefile b/client/Makefile index c12aee69..a6b1942f 100644 --- a/client/Makefile +++ b/client/Makefile @@ -103,9 +103,10 @@ CMDSRCS = crapto1/crapto1.c\ cmdlfnexwatch.c \ cmdlfnoralsy.c \ cmdlfparadox.c \ - cmdlfpcf7931.c\ - cmdlfpresco.c\ - cmdlfpyramid.c\ + cmdlfpcf7931.c \ + cmdlfpresco.c \ + cmdlfpyramid.c \ + cmdlfsecurakey.c \ cmdlft55xx.c \ cmdlfti.c \ cmdlfviking.c\ diff --git a/client/cmdlf.c b/client/cmdlf.c index 8d789a8e..005aa0e2 100644 --- a/client/cmdlf.c +++ b/client/cmdlf.c @@ -42,6 +42,7 @@ #include "cmdlfnexwatch.h"//for nexwatch menu #include "cmdlfjablotron.h" //for jablotron menu #include "cmdlfnoralsy.h"// for noralsy menu +#include "cmdlfsecurakey.h"//for securakey menu bool g_lf_threshold_set = false; static int CmdHelp(const char *Cmd); @@ -1003,6 +1004,12 @@ int CmdLFfind(const char *Cmd) return CheckChipType(cmdp); } + ans=CmdSecurakeyDemod(""); + if (ans>0) { + PrintAndLog("\nValid Securakey ID Found!"); + return CheckChipType(cmdp); + } + ans=CmdVikingDemod(""); if (ans>0) { PrintAndLog("\nValid Viking ID Found!"); @@ -1074,6 +1081,7 @@ static command_t CommandTable[] = {"presco", CmdLFPresco, 1, "{ Presco RFIDs... }"}, {"pcf7931", CmdLFPCF7931, 1, "{ PCF7931 CHIPs... }"}, {"pyramid", CmdLFPyramid, 1, "{ Farpointe/Pyramid RFIDs... }"}, + {"securakey", CmdLFSecurakey, 1, "{ Securakey RFIDs... }"}, {"t55xx", CmdLFT55XX, 1, "{ T55xx CHIPs... }"}, {"ti", CmdLFTI, 1, "{ TI CHIPs... }"}, {"viking", CmdLFViking, 1, "{ Viking RFIDs... }"}, diff --git a/client/cmdlfnoralsy.c b/client/cmdlfnoralsy.c index e56ebf7f..db450a44 100644 --- a/client/cmdlfnoralsy.c +++ b/client/cmdlfnoralsy.c @@ -111,17 +111,13 @@ int NoralsyDemod_AM(uint8_t *dest, size_t *size) { int CmdNoralsyDemod(const char *Cmd) { //ASK / Manchester - DemodBufferLen = getFromGraphBuf(DemodBuffer); - if (DemodBufferLen < 255) return 0; - int foundclk = 0; - size_t ststart = 0, stend = 0; - bool st = DetectST_ext(DemodBuffer, &DemodBufferLen, &foundclk, &ststart, &stend); - if (!st) return 0; - + bool st = false; if (!ASKDemod_ext("32 0 0", false, false, 1, &st)) { if (g_debugMode) PrintAndLog("DEBUG: Error - Noralsy: ASK/Manchester Demod failed"); return 0; } + if (!st) return 0; + size_t size = DemodBufferLen; int ans = NoralsyDemod_AM(DemodBuffer, &size); if (ans < 0){ diff --git a/client/cmdlfsecurakey.c b/client/cmdlfsecurakey.c new file mode 100644 index 00000000..1d55faf9 --- /dev/null +++ b/client/cmdlfsecurakey.c @@ -0,0 +1,143 @@ +//----------------------------------------------------------------------------- +// +// This code is licensed to you under the terms of the GNU GPL, version 2 or, +// at your option, any later version. See the LICENSE.txt file for the text of +// the license. +//----------------------------------------------------------------------------- +// Low frequency Securakey tag commands +// ASK/Manchester, RF/40, 96 bits long +//----------------------------------------------------------------------------- +#include "cmdlfsecurakey.h" +#include +#include +#include +#include "proxmark3.h" +#include "ui.h" +#include "util.h" +#include "graph.h" +#include "cmdparser.h" +#include "cmddata.h" +#include "cmdmain.h" +#include "cmdlf.h" +#include "protocols.h" // for T55xx config register definitions +#include "lfdemod.h" // preamble test +#include "parity.h" // for wiegand parity test + +static int CmdHelp(const char *Cmd); + +// by marshmellow +// find Securakey preamble in already demoded data +int SecurakeyFind(uint8_t *dest, size_t *size) { + if (*size < 96) return -1; //make sure buffer has data + size_t startIdx = 0; + uint8_t preamble[] = {0,1,1,1,1,1,1,1,1,1,0,0,1}; + if (!preambleSearch(dest, preamble, sizeof(preamble), size, &startIdx)) + return -2; //preamble not found + if (*size != 96) return -3; //wrong demoded size + //return start position + return (int)startIdx; +} + +//see ASKDemod for what args are accepted +int CmdSecurakeyDemod(const char *Cmd) { + + //ASK / Manchester + bool st = false; + if (!ASKDemod_ext("40 0 0", false, false, 1, &st)) { + if (g_debugMode) PrintAndLog("DEBUG: Error - Noralsy: ASK/Manchester Demod failed"); + return 0; + } + if (st) return 0; + size_t size = DemodBufferLen; + int ans = SecurakeyFind(DemodBuffer, &size); + if (ans < 0) { + if (g_debugMode) { + if (ans == -1) + PrintAndLog("DEBUG: Error - Securakey: too few bits found"); + else if (ans == -2) + PrintAndLog("DEBUG: Error - Securakey: preamble not found"); + else if (ans == -3) + PrintAndLog("DEBUG: Error - Securakey: Size not correct: %d", size); + else + PrintAndLog("DEBUG: Error - Securakey: ans: %d", ans); + } + return 0; + } + setDemodBuf(DemodBuffer, 96, ans); + //setGrid_Clock(40); + + //got a good demod + uint32_t raw1 = bytebits_to_byte(DemodBuffer , 32); + uint32_t raw2 = bytebits_to_byte(DemodBuffer+32, 32); + uint32_t raw3 = bytebits_to_byte(DemodBuffer+64, 32); + + // 26 bit format + // preamble ??bitlen reserved EPx xxxxxxxy yyyyyyyy yyyyyyyOP CS? CS2? + // 0111111111 0 01011010 0 00000000 0 00000010 0 00110110 0 00111110 0 01100010 0 00001111 0 01100000 0 00000000 0 0000 + + // 32 bit format + // preamble ??bitlen reserved EPxxxxxxx xxxxxxxy yyyyyyyy yyyyyyyOP CS? CS2? + // 0111111111 0 01100000 0 00000000 0 10000100 0 11001010 0 01011011 0 01010110 0 00010110 0 11100000 0 00000000 0 0000 + + // x = FC? + // y = card # + // standard wiegand parities. + // unknown checksum 11 bits? at the end + uint8_t bits_no_spacer[86]; + memcpy(bits_no_spacer, DemodBuffer + 10, 86); + + // remove marker bits (0's every 9th digit after preamble) (pType = 3 (always 0s)) + size = removeParity(bits_no_spacer, 0, 9, 3, 86); + if ( size != 86-10 ) { + if (g_debugMode) PrintAndLog("DEBUG: Error removeParity: %d", size); + return 0; + } + + uint8_t bitLen = (uint8_t)bytebits_to_byte(DemodBuffer+2, 6); + uint32_t fc=0, lWiegand=0, rWiegand=0; + // get FC + // get left 1/2 wiegand & right 1/2 wiegand (for parity test and wiegand print) + lWiegand = bytebits_to_byte(DemodBuffer + 48 - bitLen, bitLen/2); + rWiegand = bytebits_to_byte(DemodBuffer + 48 - bitLen + bitLen/2, bitLen/2); + fc = bytebits_to_byte(DemodBuffer+49-bitLen, bitLen-2-16); + + // test bitLen + if (bitLen != 26 && bitLen != 32) + PrintAndLog("***unknown securakey bitLen - share with forum***"); + + uint32_t cardid = bytebits_to_byte(DemodBuffer+8+23, 16); + // test parities + bool parity = evenparity32(lWiegand) && oddparity32(rWiegand); + + PrintAndLog("Securakey Tag Found--BitLen: %u, Card ID: %u, FC: %X, Raw: %08X%08X%08X", bitLen, cardid, fc, raw1 ,raw2, raw3); + if (bitLen <= 32) + PrintAndLog("Wiegand: %08X, Parity: %s", (lWiegand<<(bitLen/2)) | rWiegand, parity ? "Passed" : "Failed"); + PrintAndLog("\nHow the FC translates to printed FC is unknown"); + PrintAndLog("How the checksum is calculated is unknown"); + PrintAndLog("Help the community identify this format further\n by sharing your tag on the pm3 forum or with forum members"); + return 1; +} + +int CmdSecurakeyRead(const char *Cmd) { + CmdLFRead("s"); + getSamples("8000",true); + return CmdSecurakeyDemod(Cmd); +} + +static command_t CommandTable[] = { + {"help", CmdHelp, 1, "This help"}, + {"demod", CmdSecurakeyDemod,1, "Attempt to read and extract tag data from the GraphBuffer"}, + {"read", CmdSecurakeyRead, 0, "Attempt to read and extract tag data from the antenna"}, + {NULL, NULL, 0, NULL} +}; + +int CmdLFSecurakey(const char *Cmd) { + clearCommandBuffer(); + CmdsParse(CommandTable, Cmd); + return 0; +} + +int CmdHelp(const char *Cmd) { + CmdsHelp(CommandTable); + return 0; +} diff --git a/client/cmdlfsecurakey.h b/client/cmdlfsecurakey.h new file mode 100644 index 00000000..f3c0cf88 --- /dev/null +++ b/client/cmdlfsecurakey.h @@ -0,0 +1,19 @@ +//----------------------------------------------------------------------------- +// +// This code is licensed to you under the terms of the GNU GPL, version 2 or, +// at your option, any later version. See the LICENSE.txt file for the text of +// the license. +//----------------------------------------------------------------------------- +// Low frequency Securakey tag commands +//----------------------------------------------------------------------------- +#ifndef CMDLFSECURAKEY_H__ +#define CMDLFSECURAKEY_H__ + +extern int CmdLFSecurakey(const char *Cmd); +extern int CmdSecurakeyClone(const char *Cmd); +extern int CmdSecurakeySim(const char *Cmd); +extern int CmdSecurakeyRead(const char *Cmd); +extern int CmdSecurakeyDemod(const char *Cmd); + +#endif + -- 2.39.5