client/src/cmdlfvisa2000.c

   1 //-----------------------------------------------------------------------------
   2 //
   3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   4 // at your option, any later version. See the LICENSE.txt file for the text of
   5 // the license.
   6 //-----------------------------------------------------------------------------
   7 // Low frequency visa 2000 tag commands
   8 // by iceman
   9 // ASK/Manchester, RF/64, STT, 96 bits (complete)
  10 //-----------------------------------------------------------------------------
  11
  12 #include "cmdlfvisa2000.h"
  13 #include <string.h>
  14 #include <ctype.h>
  15 #include <stdlib.h>
  16 #include <inttypes.h>
  17 #include <stdio.h>
  18 #include "commonutil.h"    // ARRAYLEN
  19 #include "common.h"
  20 #include "cmdparser.h"     // command_t
  21 #include "comms.h"
  22 #include "ui.h"
  23 #include "graph.h"
  24 #include "cmddata.h"
  25 #include "cmdlf.h"
  26 #include "protocols.h"     // for T55xx config register definitions
  27 #include "lfdemod.h"       // parityTest
  28 #include "cmdlft55xx.h"    // write verify
  29 #include "cmdlfem4x05.h"   //
  30 #include "cliparser.h"
  31
  32 #ifndef VISA2k_BL0CK1
  33 #define VISA2k_BL0CK1 0x56495332
  34 #endif
  35
  36 static int CmdHelp(const char *Cmd);
  37
  38 static uint8_t visa_chksum(uint32_t id) {
  39     uint8_t sum = 0;
  40     for (uint8_t i = 0; i < 32; i += 4)
  41         sum ^= (id >> i) & 0xF;
  42     return sum & 0xF;
  43 }
  44
  45 static uint8_t visa_parity(uint32_t id) {
  46     // 4bit parity LUT
  47     uint8_t par_lut[] = {
  48         0, 1, 1, 0
  49         , 1, 0, 0, 1
  50         , 1, 0, 0, 1
  51         , 0, 1, 1, 0
  52     };
  53     uint8_t par = 0;
  54     par |= par_lut[(id >> 28) & 0xF ] << 7;
  55     par |= par_lut[(id >> 24) & 0xF ] << 6;
  56     par |= par_lut[(id >> 20) & 0xF ] << 5;
  57     par |= par_lut[(id >> 16) & 0xF ] << 4;
  58     par |= par_lut[(id >> 12) & 0xF ] << 3;
  59     par |= par_lut[(id >>  8) & 0xF ] << 2;
  60     par |= par_lut[(id >>  4) & 0xF ] << 1;
  61     par |= par_lut[(id & 0xF) ];
  62     return par;
  63 }
  64
  65 /**
  66 *
  67 * 56495332 00096ebd 00000077 —> tag id 618173
  68 * aaaaaaaa iiiiiiii -----ppc
  69 *
  70 * a = fixed value  ascii 'VIS2'
  71 * i = card id
  72 * p = even parity bit for each nibble in card id.
  73 * c = checksum  (xor of card id)
  74 *
  75 **/
  76 //see ASKDemod for what args are accepted
  77 int demodVisa2k(bool verbose) {
  78     (void) verbose; // unused so far
  79     save_restoreGB(GRAPH_SAVE);
  80
  81     //CmdAskEdgeDetect("");
  82
  83     //ASK / Manchester
  84     bool st = true;
  85     if (ASKDemod_ext(64, 0, 0, 0, false, false, false, 1, &st) != PM3_SUCCESS) {
  86         PrintAndLogEx(DEBUG, "DEBUG: Error - Visa2k: ASK/Manchester Demod failed");
  87         save_restoreGB(GRAPH_RESTORE);
  88         return PM3_ESOFT;
  89     }
  90     size_t size = DemodBufferLen;
  91     int ans = detectVisa2k(DemodBuffer, &size);
  92     if (ans < 0) {
  93         if (ans == -1)
  94             PrintAndLogEx(DEBUG, "DEBUG: Error - Visa2k: too few bits found");
  95         else if (ans == -2)
  96             PrintAndLogEx(DEBUG, "DEBUG: Error - Visa2k: preamble not found");
  97         else if (ans == -3)
  98             PrintAndLogEx(DEBUG, "DEBUG: Error - Visa2k: Size not correct: %zu", size);
  99         else
 100             PrintAndLogEx(DEBUG, "DEBUG: Error - Visa2k: ans: %d", ans);
 101
 102         save_restoreGB(GRAPH_RESTORE);
 103         return PM3_ESOFT;
 104     }
 105     setDemodBuff(DemodBuffer, 96, ans);
 106     setClockGrid(g_DemodClock, g_DemodStartIdx + (ans * g_DemodClock));
 107
 108     //got a good demod
 109     uint32_t raw1 = bytebits_to_byte(DemodBuffer, 32);
 110     uint32_t raw2 = bytebits_to_byte(DemodBuffer + 32, 32);
 111     uint32_t raw3 = bytebits_to_byte(DemodBuffer + 64, 32);
 112
 113     // chksum
 114     uint8_t calc = visa_chksum(raw2);
 115     uint8_t chk = raw3 & 0xF;
 116
 117     // test checksums
 118     if (chk != calc) {
 119         PrintAndLogEx(DEBUG, "DEBUG: error: Visa2000 checksum (%s) %x - %x\n", _RED_("fail"), chk, calc);
 120         save_restoreGB(GRAPH_RESTORE);
 121         return PM3_ESOFT;
 122     }
 123     // parity
 124     uint8_t calc_par = visa_parity(raw2);
 125     uint8_t chk_par = (raw3 & 0xFF0) >> 4;
 126     if (calc_par != chk_par) {
 127         PrintAndLogEx(DEBUG, "DEBUG: error: Visa2000 parity (%s) %x - %x\n", _RED_("fail"), chk_par, calc_par);
 128         save_restoreGB(GRAPH_RESTORE);
 129         return PM3_ESOFT;
 130     }
 131     PrintAndLogEx(SUCCESS, "Visa2000 - Card " _GREEN_("%u") ", Raw: %08X%08X%08X", raw2,  raw1, raw2, raw3);
 132     return PM3_SUCCESS;
 133 }
 134
 135 static int CmdVisa2kDemod(const char *Cmd) {
 136     CLIParserContext *ctx;
 137     CLIParserInit(&ctx, "lf visa2000 demod",
 138                   "Try to find visa2000 preamble, if found decode / descramble data",
 139                   "lf visa2000 demod"
 140                  );
 141
 142     void *argtable[] = {
 143         arg_param_begin,
 144         arg_param_end
 145     };
 146     CLIExecWithReturn(ctx, Cmd, argtable, true);
 147     CLIParserFree(ctx);
 148     return demodVisa2k(true);
 149 }
 150
 151 // 64*96*2=12288 samples just in case we just missed the first preamble we can still catch 2 of them
 152 static int CmdVisa2kReader(const char *Cmd) {
 153     CLIParserContext *ctx;
 154     CLIParserInit(&ctx, "lf visa2000 reader",
 155                   "read a visa2000 tag",
 156                   "lf visa2000 reader -@   -> continuous reader mode"
 157                  );
 158
 159     void *argtable[] = {
 160         arg_param_begin,
 161         arg_lit0("@", NULL, "optional - continuous reader mode"),
 162         arg_param_end
 163     };
 164     CLIExecWithReturn(ctx, Cmd, argtable, true);
 165     bool cm = arg_get_lit(ctx, 1);
 166     CLIParserFree(ctx);
 167
 168     if (cm) {
 169         PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " to exit");
 170     }
 171
 172     do {
 173         lf_read(false, 20000);
 174         demodVisa2k(!cm);
 175     } while (cm && !kbd_enter_pressed());
 176     return PM3_SUCCESS;
 177 }
 178
 179 static int CmdVisa2kClone(const char *Cmd) {
 180
 181     CLIParserContext *ctx;
 182     CLIParserInit(&ctx, "lf visa2000 clone",
 183                   "clone a Visa2000 tag to a T55x7, Q5/T5555 or EM4305/4469 tag.",
 184                   "lf visa2000 clone --cn 112233\n"
 185                   "lf visa2000 clone --cn 112233 --q5      -> encode for Q5/T5555 tag\n"
 186                   "lf visa2000 clone --cn 112233 --em      -> encode for EM4305/4469"
 187                  );
 188
 189     void *argtable[] = {
 190         arg_param_begin,
 191         arg_u64_1(NULL, "cn", "<dec>", "Visa2k card ID"),
 192         arg_lit0(NULL, "q5", "optional - specify writing to Q5/T5555 tag"),
 193         arg_lit0(NULL, "em", "optional - specify writing to EM4305/4469 tag"),
 194         arg_param_end
 195     };
 196     CLIExecWithReturn(ctx, Cmd, argtable, false);
 197
 198     uint32_t id = arg_get_u32_def(ctx, 1, 0);
 199     bool q5 = arg_get_lit(ctx, 2);
 200     bool em = arg_get_lit(ctx, 3);
 201     CLIParserFree(ctx);
 202
 203     if (q5 && em) {
 204         PrintAndLogEx(FAILED, "Can't specify both Q5 and EM4305 at the same time");
 205         return PM3_EINVARG;
 206     }
 207
 208     uint32_t blocks[4] = {T55x7_MODULATION_MANCHESTER | T55x7_BITRATE_RF_64 | T55x7_ST_TERMINATOR | 3 << T55x7_MAXBLOCK_SHIFT, VISA2k_BL0CK1, 0};
 209     char cardtype[16] = {"T55x7"};
 210     // Q5
 211     if (q5) {
 212         blocks[0] = T5555_FIXED | T5555_MODULATION_MANCHESTER | T5555_SET_BITRATE(64) | T5555_ST_TERMINATOR | 3 << T5555_MAXBLOCK_SHIFT;
 213         snprintf(cardtype, sizeof(cardtype), "Q5/T5555");
 214     }
 215
 216     // EM4305
 217     if (em) {
 218         blocks[0] = EM4305_VISA2000_CONFIG_BLOCK;
 219         snprintf(cardtype, sizeof(cardtype), "EM4305/4469");
 220     }
 221
 222     blocks[2] = id;
 223     blocks[3] = (visa_parity(id) << 4) | visa_chksum(id);
 224
 225     PrintAndLogEx(INFO, "Preparing to clone Visa2000 to " _YELLOW_("%s") " with CardId: " _GREEN_("%"PRIu32), cardtype, id);
 226     print_blocks(blocks,  ARRAYLEN(blocks));
 227
 228     int res;
 229     if (em) {
 230         res = em4x05_clone_tag(blocks, ARRAYLEN(blocks), 0, false);
 231     } else {
 232         res = clone_t55xx_tag(blocks, ARRAYLEN(blocks));
 233     }
 234     PrintAndLogEx(SUCCESS, "Done");
 235     PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf visa2000 reader`") " to verify");
 236     return res;
 237 }
 238
 239 static int CmdVisa2kSim(const char *Cmd) {
 240
 241     CLIParserContext *ctx;
 242     CLIParserInit(&ctx, "lf visa2000 sim",
 243                   "Enables simulation of visa2k card with specified card number.\n"
 244                   "Simulation runs until the button is pressed or another USB command is issued.\n",
 245                   "lf visa2000 sim --cn 1337"
 246                  );
 247
 248     void *argtable[] = {
 249         arg_param_begin,
 250         arg_u64_1(NULL, "cn", "<dec>", "Visa2k card ID"),
 251         arg_param_end
 252     };
 253     CLIExecWithReturn(ctx, Cmd, argtable, false);
 254     uint32_t id = arg_get_u32_def(ctx, 1, 0);
 255     CLIParserFree(ctx);
 256
 257     PrintAndLogEx(SUCCESS, "Simulating Visa2000 - CardId:" _YELLOW_("%u"), id);
 258
 259     uint32_t blocks[3] = { VISA2k_BL0CK1, id, (visa_parity(id) << 4) | visa_chksum(id) };
 260
 261     uint8_t bs[96];
 262     for (int i = 0; i < 3; ++i)
 263         num_to_bytebits(blocks[i], 32, bs + i * 32);
 264
 265     lf_asksim_t *payload = calloc(1, sizeof(lf_asksim_t) + sizeof(bs));
 266     payload->encoding =  1;
 267     payload->invert = 0;
 268     payload->separator = 1;
 269     payload->clock = 64;
 270     memcpy(payload->data, bs, sizeof(bs));
 271
 272     clearCommandBuffer();
 273     SendCommandNG(CMD_LF_ASK_SIMULATE, (uint8_t *)payload,  sizeof(lf_asksim_t) + sizeof(bs));
 274     free(payload);
 275
 276     PacketResponseNG resp;
 277     WaitForResponse(CMD_LF_ASK_SIMULATE, &resp);
 278
 279     PrintAndLogEx(INFO, "Done");
 280     if (resp.status != PM3_EOPABORTED)
 281         return resp.status;
 282     return PM3_SUCCESS;
 283 }
 284
 285 static command_t CommandTable[] = {
 286     {"help",    CmdHelp,         AlwaysAvailable, "This help"},
 287     {"demod",   CmdVisa2kDemod,  AlwaysAvailable, "demodulate an VISA2000 tag from the GraphBuffer"},
 288     {"reader",  CmdVisa2kReader, IfPm3Lf,         "attempt to read and extract tag data"},
 289     {"clone",   CmdVisa2kClone,  IfPm3Lf,         "clone Visa2000 tag to T55x7 or Q5/T5555"},
 290     {"sim",     CmdVisa2kSim,    IfPm3Lf,         "simulate Visa2000 tag"},
 291     {NULL, NULL, NULL, NULL}
 292 };
 293
 294 static int CmdHelp(const char *Cmd) {
 295     (void)Cmd; // Cmd is not used so far
 296     CmdsHelp(CommandTable);
 297     return PM3_SUCCESS;
 298 }
 299
 300 int CmdLFVisa2k(const char *Cmd) {
 301     clearCommandBuffer();
 302     return CmdsParse(CommandTable, Cmd);
 303 }
 304
 305 // by iceman
 306 // find Visa2000 preamble in already demoded data
 307 int detectVisa2k(uint8_t *dest, size_t *size) {
 308     if (*size < 96) return -1; //make sure buffer has data
 309     size_t startIdx = 0;
 310     uint8_t preamble[] = {0, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0};
 311     if (!preambleSearch(dest, preamble, sizeof(preamble), size, &startIdx))
 312         return -2; //preamble not found
 313     if (*size != 96) return -3; //wrong demoded size
 314     //return start position
 315     return (int)startIdx;
 316 }
 317
 318