client/src/cmdlfparadox.c

   1 //-----------------------------------------------------------------------------
   2 // Marshmellow
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // Low frequency Paradox tag commands
   9 // FSK2a, rf/50, 96 bits (completely known)
  10 //-----------------------------------------------------------------------------
  11 #include "cmdlfparadox.h"
  12 #include <stdio.h>
  13 #include <string.h>
  14 #include <stdlib.h>
  15 #include <ctype.h>
  16 #include "commonutil.h"   // ARRAYLEN
  17 #include "cmdparser.h"    // command_t
  18 #include "comms.h"
  19 #include "ui.h"
  20 #include "graph.h"
  21 #include "cmddata.h"
  22 #include "cmdlf.h"
  23 #include "lfdemod.h"
  24 #include "protocols.h"  // t55xx defines
  25 #include "cmdlft55xx.h" // clone..
  26 #include "crc.h"        // maxim
  27 #include "cmdlfem4x05.h"   //
  28 #include "cliparser.h"
  29
  30 static int CmdHelp(const char *Cmd);
  31
  32 const uint8_t paradox_lut[] = {
  33     0xDB, 0xFC, 0x3F, 0xC5, 0x50, 0x14, 0x05, 0x47,
  34     0x9F, 0xED, 0x7D, 0x59, 0x22, 0x84, 0x21, 0x4E,
  35     0x39, 0x48, 0x12, 0x88, 0x53, 0xDE, 0xBB, 0xE4,
  36     0xB4, 0x2D, 0x4D, 0x55, 0xCA, 0xBE, 0xA3, 0xE2
  37 };
  38 // FC:108, Card01827
  39 // 00000000  01101100       00000111     00100011
  40 // hex(0xED xor 0x7D xor 0x22 xor 0x84 xor 0xDE xor 0xBB xor 0xE4 xor 0x4D xor 0xA3 xor 0xE2 xor 0x47) 0xFC
  41
  42 #define PARADOX_PREAMBLE_LEN 8
  43
  44 // by marshmellow
  45 // Paradox Prox demod - FSK2a RF/50 with preamble of 00001111 (then manchester encoded)
  46 // print full Paradox Prox ID and some bit format details if found
  47
  48 int demodParadox(bool verbose) {
  49     (void) verbose; // unused so far
  50     //raw fsk demod no manchester decoding no start bit finding just get binary from wave
  51     uint8_t bits[MAX_GRAPH_TRACE_LEN] = {0};
  52     size_t size = getFromGraphBuf(bits);
  53     if (size == 0) {
  54         PrintAndLogEx(DEBUG, "DEBUG: Error - Paradox not enough samples");
  55         return PM3_ESOFT;
  56     }
  57
  58     int wave_idx = 0;
  59     //get binary from fsk wave
  60     int idx = detectParadox(bits, &size, &wave_idx);
  61     if (idx < 0) {
  62         if (idx == -1)
  63             PrintAndLogEx(DEBUG, "DEBUG: Error - Paradox not enough samples");
  64         else if (idx == -2)
  65             PrintAndLogEx(DEBUG, "DEBUG: Error - Paradox just noise detected");
  66         else if (idx == -3)
  67             PrintAndLogEx(DEBUG, "DEBUG: Error - Paradox problem during FSK demod");
  68         else if (idx == -4)
  69             PrintAndLogEx(DEBUG, "DEBUG: Error - Paradox preamble not found");
  70         else
  71             PrintAndLogEx(DEBUG, "DEBUG: Error - Paradox error demoding fsk %d", idx);
  72
  73         return PM3_ESOFT;
  74     }
  75
  76     uint8_t *b = bits + idx;
  77     uint8_t rawhex[12] = {0};
  78     for (uint8_t i = 0, m = 0, p = 1; i < 96; i++) {
  79
  80         // convert hex
  81         rawhex[m] <<= 1;
  82         rawhex[m] |= (*b & 1);
  83         b++;
  84
  85         if (p == 8) {
  86             m++;
  87             p = 1;
  88         } else {
  89             p++;
  90         }
  91     }
  92
  93     uint32_t hi2 = 0, hi = 0, lo = 0;
  94     uint8_t error = 0;
  95
  96     // Remove manchester encoding from FSK bits, skip pre
  97     for (uint8_t i = idx + PARADOX_PREAMBLE_LEN; i < (idx + 96); i += 2) {
  98
  99         // not manchester data
 100         if (bits[i] == bits[i + 1]) {
 101             PrintAndLogEx(WARNING, "Error Manchester at %u", i);
 102             error++;
 103         }
 104
 105         hi2 = (hi2 << 1) | (hi >> 31);
 106         hi = (hi << 1) | (lo >> 31);
 107         lo <<= 1;
 108
 109         if (bits[i] && !bits[i + 1])  {
 110             lo |= 1;  // 10
 111         }
 112     }
 113
 114     setDemodBuff(bits, size, idx);
 115     setClockGrid(50, wave_idx + (idx * 50));
 116
 117     if (hi2 == 0 && hi == 0 && lo == 0) {
 118         PrintAndLogEx(DEBUG, "DEBUG: Error - Paradox no value found");
 119         return PM3_ESOFT;
 120     }
 121
 122     uint32_t fc = ((hi & 0x3) << 6) | (lo >> 26);
 123     uint32_t cardnum = (lo >> 10) & 0xFFFF;
 124     uint8_t chksum = (lo >> 2) & 0xFF;
 125
 126
 127     // Calc CRC & Checksum
 128     // 000088f0b - FC: 8 - Card: 36619 - Checksum: 05 - RAW: 0f55555559595aa559a5566a
 129     // checksum?
 130     uint8_t calc_chksum = 0x47;
 131     uint8_t pos = 0;
 132     for (uint8_t i = 0; i < 8; i++) {
 133
 134         uint8_t ice = rawhex[i + 1];
 135         for (uint8_t j = 0x80; j > 0; j >>= 2) {
 136
 137             if (ice & j) {
 138                 calc_chksum ^= paradox_lut[pos];
 139             }
 140             pos++;
 141         }
 142     }
 143
 144     uint32_t crc = CRC8Maxim(rawhex + 1, 8);
 145     PrintAndLogEx(DEBUG, " FSK/MAN raw : %s", sprint_hex(rawhex, sizeof(rawhex)));
 146     PrintAndLogEx(DEBUG, "         raw : %s = (maxim crc8) %02x == %02x", sprint_hex(rawhex + 1, 8), crc, calc_chksum);
 147 //    PrintAndLogEx(DEBUG, " OTHER sample CRC-8/MAXIM : 55 55 69 A5 55 6A 59 5A  = FC");
 148
 149     uint32_t rawLo = bytebits_to_byte(bits + idx + 64, 32);
 150     uint32_t rawHi = bytebits_to_byte(bits + idx + 32, 32);
 151     uint32_t rawHi2 = bytebits_to_byte(bits + idx, 32);
 152
 153     PrintAndLogEx(INFO, "Paradox - ID: " _GREEN_("%x%08x") " FC: " _GREEN_("%d") " Card: " _GREEN_("%d") ", Checksum: %02x, Raw: %08x%08x%08x",
 154                   hi >> 10,
 155                   (hi & 0x3) << 26 | (lo >> 10),
 156                   fc,
 157                   cardnum,
 158                   chksum,
 159                   rawHi2,
 160                   rawHi,
 161                   rawLo
 162                  );
 163
 164     PrintAndLogEx(DEBUG, "DEBUG: Paradox idx: %d, len: %zu, Printing Demod Buffer:", idx, size);
 165     if (g_debugMode) {
 166         printDemodBuff(0, false, false, false);
 167     }
 168
 169     return PM3_SUCCESS;
 170 }
 171
 172 static int CmdParadoxDemod(const char *Cmd) {
 173     CLIParserContext *ctx;
 174     CLIParserInit(&ctx, "lf paradox demod",
 175                   "Try to find Paradox preamble, if found decode / descramble data",
 176                   "lf paradox demod"
 177                  );
 178
 179     void *argtable[] = {
 180         arg_param_begin,
 181         arg_param_end
 182     };
 183     CLIExecWithReturn(ctx, Cmd, argtable, true);
 184     CLIParserFree(ctx);
 185     return demodParadox(true);
 186 }
 187
 188 static int CmdParadoxReader(const char *Cmd) {
 189     CLIParserContext *ctx;
 190     CLIParserInit(&ctx, "lf paradox reader",
 191                   "read a Paradox tag",
 192                   "lf Paradox reader -@   -> continuous reader mode"
 193                  );
 194
 195     void *argtable[] = {
 196         arg_param_begin,
 197         arg_lit0("@", NULL, "optional - continuous reader mode"),
 198         arg_param_end
 199     };
 200     CLIExecWithReturn(ctx, Cmd, argtable, true);
 201     bool cm = arg_get_lit(ctx, 1);
 202     CLIParserFree(ctx);
 203
 204     if (cm) {
 205         PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " to exit");
 206     }
 207
 208     do {
 209         lf_read(false, 10000);
 210         demodParadox(!cm);
 211     } while (cm && !kbd_enter_pressed());
 212
 213     return PM3_SUCCESS;
 214 }
 215
 216 static int CmdParadoxClone(const char *Cmd) {
 217
 218     CLIParserContext *ctx;
 219     CLIParserInit(&ctx, "lf paradox clone",
 220                   "clone a paradox tag to a T55x7, Q5/T5555 or EM4305/4469 tag.",
 221                   "lf paradox clone --raw 0f55555695596a6a9999a59a\n"
 222                   "lf paradox clone -r 0f55555695596a6a9999a59a --q5      -> encode for Q5/T5555 tag\n"
 223                   "lf paradox clone -r 0f55555695596a6a9999a59a --em      -> encode for EM4305/4469"
 224                  );
 225
 226     void *argtable[] = {
 227         arg_param_begin,
 228         arg_str0("r", "raw", "<hex>", "raw hex data. 12 bytes max"),
 229         arg_lit0(NULL, "q5", "optional - specify writing to Q5/T5555 tag"),
 230         arg_lit0(NULL, "em", "optional - specify writing to EM4305/4469 tag"),
 231         arg_param_end
 232     };
 233     CLIExecWithReturn(ctx, Cmd, argtable, false);
 234
 235     int raw_len = 0;
 236     // skip first block,  3*4 = 12 bytes left
 237     uint8_t raw[12] = {0};
 238     CLIGetHexWithReturn(ctx, 1, raw, &raw_len);
 239
 240     bool q5 = arg_get_lit(ctx, 2);
 241     bool em = arg_get_lit(ctx, 3);
 242     CLIParserFree(ctx);
 243
 244     if (q5 && em) {
 245         PrintAndLogEx(FAILED, "Can't specify both Q5 and EM4305 at the same time");
 246         return PM3_EINVARG;
 247     }
 248
 249     if (raw_len != 12) {
 250         PrintAndLogEx(ERR, "Data must be 12 bytes (24 HEX characters)  %d", raw_len);
 251         return PM3_EINVARG;
 252     }
 253
 254     uint32_t blocks[4];
 255     for (uint8_t i = 1; i < ARRAYLEN(blocks); i++) {
 256         blocks[i] = bytes_to_num(raw + ((i - 1) * 4), sizeof(uint32_t));
 257     }
 258
 259     // Paradox - FSK2a, data rate 50, 3 data blocks
 260     blocks[0] = T55x7_MODULATION_FSK2a | T55x7_BITRATE_RF_50 | 3 << T55x7_MAXBLOCK_SHIFT;
 261     char cardtype[16] = {"T55x7"};
 262     // Q5
 263     if (q5) {
 264         blocks[0] = T5555_FIXED | T5555_INVERT_OUTPUT | T5555_MODULATION_FSK2 | T5555_SET_BITRATE(50) | T5555_ST_TERMINATOR | 3 << T5555_MAXBLOCK_SHIFT;
 265         snprintf(cardtype, sizeof(cardtype), "Q5/T5555");
 266     }
 267
 268     // EM4305
 269     if (em) {
 270         blocks[0] = EM4305_PARADOX_CONFIG_BLOCK;
 271         snprintf(cardtype, sizeof(cardtype), "EM4305/4469");
 272     }
 273
 274     PrintAndLogEx(INFO, "Preparing to clone Paradox to " _YELLOW_("%s") " with raw hex", cardtype);
 275     print_blocks(blocks,  ARRAYLEN(blocks));
 276
 277     int res;
 278     if (em) {
 279         res = em4x05_clone_tag(blocks, ARRAYLEN(blocks), 0, false);
 280     } else {
 281         res = clone_t55xx_tag(blocks, ARRAYLEN(blocks));
 282     }
 283     PrintAndLogEx(SUCCESS, "Done");
 284     PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf paradox read`") " to verify");
 285     return res;
 286 }
 287
 288 static int CmdParadoxSim(const char *Cmd) {
 289
 290     CLIParserContext *ctx;
 291     CLIParserInit(&ctx, "lf paradox sim",
 292                   "Enables simulation of paradox card with specified card number.\n"
 293                   "Simulation runs until the button is pressed or another USB command is issued.",
 294                   "lf paradox sim --raw 0f55555695596a6a9999a59a"
 295                  );
 296
 297     void *argtable[] = {
 298         arg_param_begin,
 299         arg_str0("r", "raw", "<hex>", " raw hex data. 12 bytes"),
 300         arg_param_end
 301     };
 302     CLIExecWithReturn(ctx, Cmd, argtable, false);
 303
 304     int raw_len = 0;
 305     // skip first block,  3*4 = 12 bytes left
 306     uint8_t raw[12] = {0};
 307     CLIGetHexWithReturn(ctx, 1, raw, &raw_len);
 308     CLIParserFree(ctx);
 309
 310     if (raw_len != 12) {
 311         PrintAndLogEx(ERR, "Data must be 12 bytes (24 HEX characters)  %d", raw_len);
 312         return PM3_EINVARG;
 313     }
 314
 315     PrintAndLogEx(SUCCESS, "Simulating Paradox -  raw " _YELLOW_("%s"), sprint_hex_inrow(raw, sizeof(raw)));
 316
 317     uint8_t bs[sizeof(raw) * 8];
 318     bytes_to_bytebits(raw, sizeof(raw), bs);
 319
 320     // Paradox uses:  fcHigh: 10, fcLow: 8, clk: 50, invert: 1  FSK2a
 321     uint8_t clk = 50, high = 10, low = 8;
 322
 323     lf_fsksim_t *payload = calloc(1, sizeof(lf_fsksim_t) + sizeof(bs));
 324     payload->fchigh = high;
 325     payload->fclow =  low;
 326     payload->separator = 0;
 327     payload->clock = clk;
 328     memcpy(payload->data, bs, sizeof(bs));
 329
 330     clearCommandBuffer();
 331     SendCommandNG(CMD_LF_FSK_SIMULATE, (uint8_t *)payload,  sizeof(lf_fsksim_t) + sizeof(bs));
 332     free(payload);
 333
 334     PacketResponseNG resp;
 335     WaitForResponse(CMD_LF_FSK_SIMULATE, &resp);
 336
 337     PrintAndLogEx(INFO, "Done");
 338     if (resp.status != PM3_EOPABORTED)
 339         return resp.status;
 340
 341     return PM3_SUCCESS;
 342 }
 343 /*
 344
 345     if (sscanf(Cmd, "%u %u", &fc, &cn) != 2) return usage_lf_paradox_sim();
 346
 347     facilitycode = (fc & 0x000000FF);
 348     cardnumber = (cn & 0x0000FFFF);
 349
 350     // if ( GetParadoxBits(facilitycode, cardnumber, bs) != PM3_SUCCESS) {
 351     // PrintAndLogEx(ERR, "Error with tag bitstream generation.");
 352     // return 1;
 353     // }
 354
 355     PrintAndLogEx(NORMAL, "Simulating Paradox - Facility Code: %u, CardNumber: %u", facilitycode, cardnumber);
 356
 357 */
 358 static command_t CommandTable[] = {
 359     {"help",   CmdHelp,          AlwaysAvailable, "This help"},
 360     {"demod",  CmdParadoxDemod,  AlwaysAvailable, "demodulate a Paradox FSK tag from the GraphBuffer"},
 361     {"reader", CmdParadoxReader, IfPm3Lf,         "attempt to read and extract tag data"},
 362     {"clone",  CmdParadoxClone,  IfPm3Lf,         "clone paradox tag"},
 363     {"sim",    CmdParadoxSim,    IfPm3Lf,         "simulate paradox tag"},
 364     {NULL, NULL, NULL, NULL}
 365 };
 366
 367 static int CmdHelp(const char *Cmd) {
 368     (void)Cmd; // Cmd is not used so far
 369     CmdsHelp(CommandTable);
 370     return PM3_SUCCESS;
 371 }
 372
 373 int CmdLFParadox(const char *Cmd) {
 374     clearCommandBuffer();
 375     return CmdsParse(CommandTable, Cmd);
 376 }
 377
 378 // loop to get raw paradox waveform then FSK demodulate the TAG ID from it
 379 int detectParadox(uint8_t *dest, size_t *size, int *wave_start_idx) {
 380     //make sure buffer has data
 381     if (*size < 96 * 50) return -1;
 382
 383     if (getSignalProperties()->isnoise) return -2;
 384
 385     // FSK demodulator
 386     *size = fskdemod(dest, *size, 50, 1, 10, 8, wave_start_idx); // paradox fsk2a
 387
 388     //did we get a good demod?
 389     if (*size < 96) return -3;
 390
 391     // 00001111 bit pattern represent start of frame, 01 pattern represents a 0 and 10 represents a 1
 392     size_t idx = 0;
 393     uint8_t preamble[] = {0, 0, 0, 0, 1, 1, 1, 1};
 394     if (!preambleSearch(dest, preamble, sizeof(preamble), size, &idx))
 395         return -4; //preamble not found
 396
 397     return (int)idx;
 398 }
 399
 400