client/src/cmdlfnoralsy.c

   1 //-----------------------------------------------------------------------------
   2 //
   3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   4 // at your option, any later version. See the LICENSE.txt file for the text of
   5 // the license.
   6 //-----------------------------------------------------------------------------
   7 // Low frequency Noralsy tag commands
   8 // ASK/Manchester, STT, RF/32, 96 bits long (some bits unknown)
   9 //-----------------------------------------------------------------------------
  10 #include "cmdlfnoralsy.h"
  11 #include <string.h>
  12 #include <stdlib.h>
  13 #include <ctype.h>
  14 #include "commonutil.h"   // ARRAYLEN
  15 #include "cmdparser.h"    // command_t
  16 #include "comms.h"
  17 #include "ui.h"
  18 #include "cmddata.h"
  19 #include "cmdlf.h"
  20 #include "protocols.h"    // for T55xx config register definitions
  21 #include "lfdemod.h"      // parityTest
  22 #include "cmdlft55xx.h"   // verifywrite
  23 #include "cmdlfem4x05.h"  //
  24 #include "cliparser.h"
  25
  26 static int CmdHelp(const char *Cmd);
  27
  28 static uint8_t noralsy_chksum(uint8_t *bits, uint8_t len) {
  29     uint8_t sum = 0;
  30     for (uint8_t i = 0; i < len; i += 4)
  31         sum ^= bytebits_to_byte(bits + i, 4);
  32     return sum & 0x0F ;
  33 }
  34
  35 //see ASKDemod for what args are accepted
  36 int demodNoralsy(bool verbose) {
  37     (void) verbose; // unused so far
  38     //ASK / Manchester
  39     bool st = true;
  40     if (ASKDemod_ext(32, 0, 0, 0, false, false, false, 1, &st) != PM3_SUCCESS) {
  41         if (g_debugMode) PrintAndLogEx(DEBUG, "DEBUG: Error - Noralsy: ASK/Manchester Demod failed");
  42         return PM3_ESOFT;
  43     }
  44     if (!st) {
  45         if (g_debugMode) PrintAndLogEx(DEBUG, "DEBUG: Error - Noralsy: sequence terminator not found");
  46         return PM3_ESOFT;
  47     }
  48
  49     size_t size = DemodBufferLen;
  50     int ans = detectNoralsy(DemodBuffer, &size);
  51     if (ans < 0) {
  52         if (g_debugMode) {
  53             if (ans == -1)
  54                 PrintAndLogEx(DEBUG, "DEBUG: Error - Noralsy: too few bits found");
  55             else if (ans == -2)
  56                 PrintAndLogEx(DEBUG, "DEBUG: Error - Noralsy: preamble not found");
  57             else if (ans == -3)
  58                 PrintAndLogEx(DEBUG, "DEBUG: Error - Noralsy: Size not correct: %zu", size);
  59             else
  60                 PrintAndLogEx(DEBUG, "DEBUG: Error - Noralsy: ans: %d", ans);
  61         }
  62         return PM3_ESOFT;
  63     }
  64     setDemodBuff(DemodBuffer, 96, ans);
  65     setClockGrid(g_DemodClock, g_DemodStartIdx + (ans * g_DemodClock));
  66
  67     //got a good demod
  68     uint32_t raw1 = bytebits_to_byte(DemodBuffer, 32);
  69     uint32_t raw2 = bytebits_to_byte(DemodBuffer + 32, 32);
  70     uint32_t raw3 = bytebits_to_byte(DemodBuffer + 64, 32);
  71
  72     uint32_t cardid = ((raw2 & 0xFFF00000) >> 20) << 16;
  73     cardid |= (raw2 & 0xFF) << 8;
  74     cardid |= ((raw3 & 0xFF000000) >> 24);
  75     cardid = BCD2DEC(cardid);
  76
  77     uint16_t year = (raw2 & 0x000ff000) >> 12;
  78     year = BCD2DEC(year);
  79     year += (year > 60) ? 1900 : 2000;
  80
  81     // calc checksums
  82     uint8_t calc1 = noralsy_chksum(DemodBuffer + 32, 40);
  83     uint8_t calc2 = noralsy_chksum(DemodBuffer, 76);
  84     uint8_t chk1 = 0, chk2 = 0;
  85     chk1 = bytebits_to_byte(DemodBuffer + 72, 4);
  86     chk2 = bytebits_to_byte(DemodBuffer + 76, 4);
  87     // test checksums
  88     if (chk1 != calc1) {
  89         if (g_debugMode) PrintAndLogEx(DEBUG, "DEBUG: Error - Noralsy: checksum 1 failed %x - %x\n", chk1, calc1);
  90         return PM3_ESOFT;
  91     }
  92     if (chk2 != calc2) {
  93         if (g_debugMode) PrintAndLogEx(DEBUG, "DEBUG: Error - Noralsy: checksum 2 failed %x - %x\n", chk2, calc2);
  94         return PM3_ESOFT;
  95     }
  96
  97     PrintAndLogEx(SUCCESS, "Noralsy - Card: " _GREEN_("%u")", Year: " _GREEN_("%u") ", Raw: %08X%08X%08X", cardid, year, raw1, raw2, raw3);
  98     if (raw1 != 0xBB0214FF) {
  99         PrintAndLogEx(WARNING, "Unknown bits set in first block! Expected 0xBB0214FF, Found: 0x%08X", raw1);
 100         PrintAndLogEx(WARNING, "Please post this output in forum to further research on this format");
 101     }
 102     return PM3_SUCCESS;
 103 }
 104
 105 static int CmdNoralsyDemod(const char *Cmd) {
 106     CLIParserContext *ctx;
 107     CLIParserInit(&ctx, "lf noralsy demod",
 108                   "Try to find Noralsy preamble, if found decode / descramble data",
 109                   "lf noralsy demod"
 110                  );
 111
 112     void *argtable[] = {
 113         arg_param_begin,
 114         arg_param_end
 115     };
 116     CLIExecWithReturn(ctx, Cmd, argtable, true);
 117     CLIParserFree(ctx);
 118     return demodNoralsy(true);
 119 }
 120
 121 static int CmdNoralsyReader(const char *Cmd) {
 122     CLIParserContext *ctx;
 123     CLIParserInit(&ctx, "lf noralsy reader",
 124                   "read a Noralsy tag",
 125                   "lf noralsy reader -@   -> continuous reader mode"
 126                  );
 127
 128     void *argtable[] = {
 129         arg_param_begin,
 130         arg_lit0("@", NULL, "optional - continuous reader mode"),
 131         arg_param_end
 132     };
 133     CLIExecWithReturn(ctx, Cmd, argtable, true);
 134     bool cm = arg_get_lit(ctx, 1);
 135     CLIParserFree(ctx);
 136
 137     if (cm) {
 138         PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " to exit");
 139     }
 140
 141     do {
 142         lf_read(false, 8000);
 143         demodNoralsy(!cm);
 144     } while (cm && !kbd_enter_pressed());
 145     return PM3_SUCCESS;
 146 }
 147
 148 static int CmdNoralsyClone(const char *Cmd) {
 149     CLIParserContext *ctx;
 150     CLIParserInit(&ctx, "lf noralsy clone",
 151                   "clone a Noralsy tag to a T55x7, Q5/T5555 or EM4305/4469 tag.",
 152                   "lf noralsy clone --cn 112233\n"
 153                   "lf noralsy clone --cn 112233 --q5      -> encode for Q5/T5555 tag\n"
 154                   "lf noralsy clone --cn 112233 --em      -> encode for EM4305/4469"
 155                  );
 156
 157     void *argtable[] = {
 158         arg_param_begin,
 159         arg_u64_1(NULL, "cn", "<dec>", "Noralsy card ID"),
 160         arg_u64_0("y", "year", "<dec>", "tag allocation year"),
 161         arg_lit0(NULL, "q5", "optional - specify writing to Q5/T5555 tag"),
 162         arg_lit0(NULL, "em", "optional - specify writing to EM4305/4469 tag"),
 163         arg_param_end
 164     };
 165     CLIExecWithReturn(ctx, Cmd, argtable, false);
 166
 167     uint32_t id = arg_get_u32_def(ctx, 1, 0);
 168     uint16_t year = arg_get_u32_def(ctx, 2, 2000);
 169     bool q5 = arg_get_lit(ctx, 3);
 170     bool em = arg_get_lit(ctx, 4);
 171     CLIParserFree(ctx);
 172
 173     if (q5 && em) {
 174         PrintAndLogEx(FAILED, "Can't specify both Q5 and EM4305 at the same time");
 175         return PM3_EINVARG;
 176     }
 177
 178     uint32_t blocks[4] = {T55x7_MODULATION_MANCHESTER | T55x7_BITRATE_RF_32 | T55x7_ST_TERMINATOR | 3 << T55x7_MAXBLOCK_SHIFT, 0, 0};
 179     char cardtype[16] = {"T55x7"};
 180     //Q5
 181     if (q5) {
 182         blocks[0] = T5555_FIXED | T5555_MODULATION_MANCHESTER | T5555_SET_BITRATE(32) | T5555_ST_TERMINATOR | 3 << T5555_MAXBLOCK_SHIFT;
 183         snprintf(cardtype, sizeof(cardtype), "Q5/T5555");
 184     }
 185
 186     // EM4305
 187     if (em) {
 188         blocks[0] = EM4305_NORALSY_CONFIG_BLOCK;
 189         snprintf(cardtype, sizeof(cardtype), "EM4305/4469");
 190     }
 191
 192     uint8_t *bits = calloc(96, sizeof(uint8_t));
 193     if (getnoralsyBits(id, year, bits) != PM3_SUCCESS) {
 194         PrintAndLogEx(ERR, "Error with tag bitstream generation.");
 195         free(bits);
 196         return PM3_ESOFT;
 197     }
 198
 199     blocks[1] = bytebits_to_byte(bits, 32);
 200     blocks[2] = bytebits_to_byte(bits + 32, 32);
 201     blocks[3] = bytebits_to_byte(bits + 64, 32);
 202
 203     free(bits);
 204
 205     PrintAndLogEx(INFO, "Preparing to clone Noralsy to " _YELLOW_("%s") " with Card id: " _GREEN_("%u"), cardtype, id);
 206     print_blocks(blocks,  ARRAYLEN(blocks));
 207
 208     int res;
 209     if (em) {
 210         res = em4x05_clone_tag(blocks, ARRAYLEN(blocks), 0, false);
 211     } else {
 212         res = clone_t55xx_tag(blocks, ARRAYLEN(blocks));
 213     }
 214     PrintAndLogEx(SUCCESS, "Done");
 215     PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf noralsy reader`") " to verify");
 216     return res;
 217 }
 218
 219 static int CmdNoralsySim(const char *Cmd) {
 220
 221     CLIParserContext *ctx;
 222     CLIParserInit(&ctx, "lf noralsy sim",
 223                   "Enables simulation of Noralsy card with specified card number.\n"
 224                   "Simulation runs until the button is pressed or another USB command is issued.\n",
 225                   "lf noralsy sim --cn 1337\n"
 226                   "lf noralsy sim --cn 1337 --year 2010"
 227                  );
 228
 229     void *argtable[] = {
 230         arg_param_begin,
 231         arg_u64_1(NULL, "cn", "<dec>", "Noralsy card ID"),
 232         arg_u64_0("y", "year", "<dec>", "tag allocation year"),
 233         arg_param_end
 234     };
 235     CLIExecWithReturn(ctx, Cmd, argtable, false);
 236     uint32_t id = arg_get_u32_def(ctx, 1, 0);
 237     uint16_t year = arg_get_u32_def(ctx, 2, 2000);
 238     CLIParserFree(ctx);
 239
 240     uint8_t bs[96];
 241     memset(bs, 0, sizeof(bs));
 242
 243     if (getnoralsyBits(id, year, bs) != PM3_SUCCESS) {
 244         PrintAndLogEx(ERR, "Error with tag bitstream generation.");
 245         return PM3_ESOFT;
 246     }
 247
 248     PrintAndLogEx(SUCCESS, "Simulating Noralsy - CardId: " _YELLOW_("%u") " year " _YELLOW_("%u"), id, year);
 249
 250     lf_asksim_t *payload = calloc(1, sizeof(lf_asksim_t) + sizeof(bs));
 251     payload->encoding = 1;
 252     payload->invert = 0;
 253     payload->separator = 1;
 254     payload->clock = 32;
 255     memcpy(payload->data, bs, sizeof(bs));
 256
 257     clearCommandBuffer();
 258     SendCommandNG(CMD_LF_ASK_SIMULATE, (uint8_t *)payload,  sizeof(lf_asksim_t) + sizeof(bs));
 259     free(payload);
 260
 261     PacketResponseNG resp;
 262     WaitForResponse(CMD_LF_ASK_SIMULATE, &resp);
 263
 264     PrintAndLogEx(INFO, "Done");
 265     if (resp.status != PM3_EOPABORTED)
 266         return resp.status;
 267
 268     return PM3_SUCCESS;
 269 }
 270
 271 static command_t CommandTable[] = {
 272     {"help",    CmdHelp,          AlwaysAvailable, "This help"},
 273     {"demod",   CmdNoralsyDemod,  AlwaysAvailable, "demodulate an Noralsy tag from the GraphBuffer"},
 274     {"reader",  CmdNoralsyReader, IfPm3Lf,         "attempt to read and extract tag data"},
 275     {"clone",   CmdNoralsyClone,  IfPm3Lf,         "clone Noralsy tag to T55x7 or Q5/T5555"},
 276     {"sim",     CmdNoralsySim,    IfPm3Lf,         "simulate Noralsy tag"},
 277     {NULL, NULL, NULL, NULL}
 278 };
 279
 280 static int CmdHelp(const char *Cmd) {
 281     (void)Cmd; // Cmd is not used so far
 282     CmdsHelp(CommandTable);
 283     return PM3_SUCCESS;
 284 }
 285
 286 int CmdLFNoralsy(const char *Cmd) {
 287     clearCommandBuffer();
 288     return CmdsParse(CommandTable, Cmd);
 289 }
 290
 291 int getnoralsyBits(uint32_t id, uint16_t year, uint8_t *bits) {
 292     //preamp
 293     num_to_bytebits(0xBB0214FF, 32, bits);  // --> Have seen 0xBB0214FF / 0xBB0314FF  UNKNOWN
 294
 295     //convert ID into BCD-format
 296     id = DEC2BCD(id);
 297     year = DEC2BCD(year);
 298     year &= 0xFF;
 299
 300     uint16_t sub1 = (id & 0xFFF0000) >> 16;
 301     uint8_t sub2 = (id & 0x000FF00) >> 8;
 302     uint8_t sub3 = (id & 0x00000FF);
 303
 304     num_to_bytebits(sub1, 12, bits + 32);
 305     num_to_bytebits(year, 8, bits + 44);
 306     num_to_bytebits(0, 4, bits + 52); // --> UNKNOWN. Flag?
 307
 308     num_to_bytebits(sub2, 8, bits + 56);
 309     num_to_bytebits(sub3, 8, bits + 64);
 310
 311     //chksum byte
 312     uint8_t chksum = noralsy_chksum(bits + 32, 40);
 313     num_to_bytebits(chksum, 4, bits + 72);
 314     chksum = noralsy_chksum(bits, 76);
 315     num_to_bytebits(chksum, 4, bits + 76);
 316     return PM3_SUCCESS;
 317 }
 318
 319 // find Noralsy preamble in already demoded data
 320 int detectNoralsy(uint8_t *dest, size_t *size) {
 321     if (*size < 96) return -1; //make sure buffer has data
 322     size_t startIdx = 0;
 323     uint8_t preamble[] = {1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0};
 324     if (!preambleSearch(dest, preamble, sizeof(preamble), size, &startIdx))
 325         return -2; //preamble not found
 326     if (*size != 96) return -3; //wrong demoded size
 327     //return start position
 328     return (int)startIdx;
 329 }
 330 /*
 331 *
 332 * 2520116 | BB0214FF2529900116360000 | 10111011 00000011 00010100 11111111 00100101 00101001 10010000 00000001 00010110 00110110 00000000 00000000
 333 *           aaa*aaaaiiiYY*iiiicc----                ****                   iiiiiiii iiiiYYYY YYYY**** iiiiiiii iiiiiiii cccccccc
 334 *
 335 * a = fixed value BB0*14FF
 336 * i = printed id, BCD-format
 337 * Y = year
 338 * c = checksum
 339 * * = unknown
 340 *
 341 **/