client/src/cmdlfidteck.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) Proxmark3 contributors. See AUTHORS.md for details.
   3 //
   4 // This program is free software: you can redistribute it and/or modify
   5 // it under the terms of the GNU General Public License as published by
   6 // the Free Software Foundation, either version 3 of the License, or
   7 // (at your option) any later version.
   8 //
   9 // This program is distributed in the hope that it will be useful,
  10 // but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12 // GNU General Public License for more details.
  13 //
  14 // See LICENSE.txt for the text of the license.
  15 //-----------------------------------------------------------------------------
  16 // Low frequency Idteck tag commands
  17 // PSK1,  clk 32,  2 data blocks
  18 //-----------------------------------------------------------------------------
  19 #include "cmdlfidteck.h"
  20 #include <string.h>
  21 #include <stdlib.h>
  22 #include <ctype.h>
  23 #include "common.h"
  24 #include "cmdparser.h"   // command_t
  25 #include "comms.h"
  26 #include "ui.h"
  27 #include "cmddata.h"
  28 #include "cmdlf.h"
  29 #include "lfdemod.h"
  30 #include "commonutil.h"  // num_to_bytes
  31 #include "cliparser.h"
  32 #include "cmdlfem4x05.h" // EM defines
  33 #include "protocols.h"   // T55x7 defines
  34 #include "cmdlft55xx.h"  // verifywrite
  35 #include "generator.h"
  36 #include "wiegand_formats.h"
  37
  38 static int CmdHelp(const char *Cmd);
  39
  40 static int demod_idteck_signal(void) {
  41     if (PSKDemod(0, 0, 100, false) != PM3_SUCCESS) {
  42         PrintAndLogEx(DEBUG, "DEBUG: Error - Idteck PSKDemod failed");
  43         return PM3_ESOFT;
  44     }
  45     size_t size = g_DemodBufferLen;
  46
  47     // get binary from PSK1 wave
  48     int idx = detectIdteck(g_DemodBuffer, &size);
  49     if (idx < 0) {
  50
  51         if (idx == -1)
  52             PrintAndLogEx(DEBUG, "DEBUG: Error - Idteck: not enough samples");
  53         else if (idx == -2)
  54             PrintAndLogEx(DEBUG, "DEBUG: Error - Idteck: just noise");
  55         else if (idx == -3)
  56             PrintAndLogEx(DEBUG, "DEBUG: Error - Idteck: preamble not found");
  57         else if (idx == -4)
  58             PrintAndLogEx(DEBUG, "DEBUG: Error - Idteck: size not correct: %zu", size);
  59         else
  60             PrintAndLogEx(DEBUG, "DEBUG: Error - Idteck: idx: %d", idx);
  61
  62         // if didn't find preamble try again inverting
  63         if (PSKDemod(0, 1, 100, false) != PM3_SUCCESS) {
  64             PrintAndLogEx(DEBUG, "DEBUG: Error - Idteck PSKDemod failed");
  65             return PM3_ESOFT;
  66         }
  67         idx = detectIdteck(g_DemodBuffer, &size);
  68         if (idx < 0) {
  69
  70             if (idx == -1)
  71                 PrintAndLogEx(DEBUG, "DEBUG: Error - Idteck: not enough samples");
  72             else if (idx == -2)
  73                 PrintAndLogEx(DEBUG, "DEBUG: Error - Idteck: just noise");
  74             else if (idx == -3)
  75                 PrintAndLogEx(DEBUG, "DEBUG: Error - Idteck: preamble not found");
  76             else if (idx == -4)
  77                 PrintAndLogEx(DEBUG, "DEBUG: Error - Idteck: size not correct: %zu", size);
  78             else
  79                 PrintAndLogEx(DEBUG, "DEBUG: Error - Idteck: idx: %d", idx);
  80
  81             return PM3_ESOFT;
  82         }
  83     }
  84     setDemodBuff(g_DemodBuffer, 64, idx);
  85     return PM3_SUCCESS;
  86 }
  87
  88 int demodIdteck(uint8_t *raw, bool verbose) {
  89     (void) verbose; // unused so far
  90
  91     uint32_t raw1 = 0;
  92     uint32_t raw2 = 0;
  93
  94     if (raw == NULL) {
  95         // get binary from PSK1 wave
  96         int ret = demod_idteck_signal();
  97         if (ret != PM3_SUCCESS) {
  98             return ret;
  99         }
 100         raw1 = bytebits_to_byte(g_DemodBuffer, 32);
 101         raw2 = bytebits_to_byte(g_DemodBuffer + 32, 32);
 102     } else {
 103         raw1 = bytes_to_num(raw, 4);
 104         raw2 = bytes_to_num(raw + 4, 4);
 105     }
 106
 107     // got a good demod
 108     uint32_t id = 0;
 109
 110     if (raw1 != 0x4944544B) {
 111         PrintAndLogEx(FAILED, "No genuine IDTECK found");
 112     }
 113
 114     // parity check (TBD)
 115
 116     uint32_t tmp = raw2;
 117
 118     // checksum check (TBD)
 119     // 351FBE4B  ->  90370752   Card Code  [523707]  CUSUM = 52+37+07=90
 120     // So, first byte is Csum
 121     uint8_t chksum = ((tmp >> 24) & 0xFF);
 122     uint8_t calc = ((tmp >> 16) & 0xFF) +
 123                    ((tmp >> 8) & 0xFF) +
 124                    (tmp & 0xFF);
 125
 126     id = ((tmp >> 16) & 0xFF) | ((tmp >> 8) & 0xFF) << 8 | (tmp & 0xFF) << 16;
 127
 128     // output
 129     PrintAndLogEx(SUCCESS, "IDTECK Tag Found: Card ID " _GREEN_("%u") " ( 0x%06X ) Raw: %08X%08X  chksum 0x%02X ( %s )",
 130                   id,
 131                   id,
 132                   raw1,
 133                   raw2,
 134                   chksum,
 135                   (chksum == calc) ? _GREEN_("ok") : _RED_("fail")
 136                  );
 137
 138     wiegand_message_t packed = {
 139         .Bot = id,
 140         .Mid = 0,
 141         .Top = 0,
 142         .Length = 26
 143     };
 144     HIDUnpack(0, &packed);
 145     return PM3_SUCCESS;
 146 }
 147
 148 static int CmdIdteckDemod(const char *Cmd) {
 149     CLIParserContext *ctx;
 150     CLIParserInit(&ctx, "lf idteck demod",
 151                   "Try to find Idteck preamble, if found decode / descramble data",
 152                   "lf idteck demod\n"
 153                   "lf idteck demod --raw 4944544B351FBE4B"
 154                  );
 155
 156     void *argtable[] = {
 157         arg_param_begin,
 158         arg_str0("r", "raw", "<hex>", "raw bytes"),
 159         arg_param_end
 160     };
 161     CLIExecWithReturn(ctx, Cmd, argtable, true);
 162     int raw_len = 0;
 163     uint8_t raw[8] = {0};
 164     CLIGetHexWithReturn(ctx, 1, raw, &raw_len);
 165     CLIParserFree(ctx);
 166     return demodIdteck(raw, true);
 167 }
 168
 169 static int CmdIdteckClone(const char *Cmd) {
 170     CLIParserContext *ctx;
 171     CLIParserInit(&ctx, "lf idteck clone",
 172                   "clone a Idteck tag to T55x7 or Q5/T5555 tag\n"
 173                   "Tag must be on the antenna when issuing this command.",
 174                   "lf idteck clone --raw 4944544B351FBE4B"
 175                  );
 176     void *argtable[] = {
 177         arg_param_begin,
 178         arg_str1("r", "raw", "<hex>", "raw bytes"),
 179         arg_lit0(NULL, "q5", "optional - specify writing to Q5/T5555 tag"),
 180         arg_lit0(NULL, "em", "optional - specify writing to EM4305/4469 tag"),
 181         arg_param_end
 182     };
 183     CLIExecWithReturn(ctx, Cmd, argtable, false);
 184
 185     int raw_len = 0;
 186     uint8_t raw[8] = {0};
 187     CLIGetHexWithReturn(ctx, 1, raw, &raw_len);
 188
 189     bool q5 = arg_get_lit(ctx, 2);
 190     bool em = arg_get_lit(ctx, 3);
 191     CLIParserFree(ctx);
 192
 193     if (q5 && em) {
 194         PrintAndLogEx(FAILED, "Can't specify both Q5 and EM4305 at the same time");
 195         return PM3_EINVARG;
 196     }
 197
 198     uint32_t blocks[3] = {T55x7_MODULATION_PSK1 | T55x7_BITRATE_RF_32 | 2 << T55x7_MAXBLOCK_SHIFT, 0, 0};
 199     char cardtype[16] = {"T55x7"};
 200
 201     // Q5
 202     if (q5) {
 203         blocks[0] = T5555_FIXED | T55x7_MODULATION_PSK1 |  T5555_SET_BITRATE(32) | 2 << T5555_MAXBLOCK_SHIFT;
 204         snprintf(cardtype, sizeof(cardtype), "Q5/T5555");
 205     }
 206
 207     if (em) {
 208         blocks[0] = EM4305_IDTECK_CONFIG_BLOCK;
 209         snprintf(cardtype, sizeof(cardtype), "EM4305/4469");
 210     }
 211
 212     for (uint8_t i = 1; i < ARRAYLEN(blocks); i++) {
 213         blocks[i] = bytes_to_num(raw + ((i - 1) * 4), sizeof(uint32_t));
 214     }
 215
 216     // config for Indala 64 format (RF/32;PSK1 with RF/2;Maxblock=2)
 217     PrintAndLogEx(INFO, "Preparing to clone Idteck to " _YELLOW_("%s") " raw " _GREEN_("%s")
 218                   , cardtype
 219                   , sprint_hex_inrow(raw, raw_len)
 220                  );
 221     print_blocks(blocks,  ARRAYLEN(blocks));
 222
 223     int res;
 224     if (em) {
 225         res = em4x05_clone_tag(blocks, ARRAYLEN(blocks), 0, false);
 226     } else {
 227         res = clone_t55xx_tag(blocks, ARRAYLEN(blocks));
 228     }
 229     PrintAndLogEx(SUCCESS, "Done!");
 230     PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf idteck reader`") " to verify");
 231     return res;
 232 }
 233
 234 static int CmdIdteckSim(const char *Cmd) {
 235     CLIParserContext *ctx;
 236     CLIParserInit(&ctx, "lf idteck sim",
 237                   "Enables simulation of Idteck card.\n"
 238                   "Simulation runs until the button is pressed or another USB command is issued.",
 239                   "lf idteck sim --raw 4944544B351FBE4B"
 240                  );
 241
 242     void *argtable[] = {
 243         arg_param_begin,
 244         arg_str1("r", "raw", "<hex>", "raw bytes"),
 245         arg_param_end
 246     };
 247     CLIExecWithReturn(ctx, Cmd, argtable, false);
 248
 249     int raw_len = 0;
 250     uint8_t raw[8] = {0};
 251     CLIGetHexWithReturn(ctx, 1, raw, &raw_len);
 252     CLIParserFree(ctx);
 253
 254     // convert to binarray
 255     uint8_t bs[64];
 256     memset(bs, 0x00, sizeof(bs));
 257
 258     uint8_t counter = 0;
 259     for (int32_t i = 0; i < raw_len; i++) {
 260         uint8_t tmp = raw[i];
 261         bs[counter++] = (tmp >> 7) & 1;
 262         bs[counter++] = (tmp >> 6) & 1;
 263         bs[counter++] = (tmp >> 5) & 1;
 264         bs[counter++] = (tmp >> 4) & 1;
 265         bs[counter++] = (tmp >> 3) & 1;
 266         bs[counter++] = (tmp >> 2) & 1;
 267         bs[counter++] = (tmp >> 1) & 1;
 268         bs[counter++] = tmp & 1;
 269     }
 270
 271     PrintAndLogEx(SUCCESS, "Simulating Idteck - raw " _YELLOW_("%s"), sprint_hex_inrow(raw, raw_len));
 272     PrintAndLogEx(SUCCESS, "Press " _GREEN_("pm3 button") " to abort simulation or run another command");
 273     PrintAndLogEx(NORMAL, "");
 274
 275     lf_psksim_t *payload = calloc(1, sizeof(lf_psksim_t) + sizeof(bs));
 276     payload->carrier = 2;
 277     payload->invert = 0;
 278     payload->clock = 32;
 279     memcpy(payload->data, bs, sizeof(bs));
 280
 281     clearCommandBuffer();
 282     SendCommandNG(CMD_LF_PSK_SIMULATE, (uint8_t *)payload,  sizeof(lf_psksim_t) + sizeof(bs));
 283     free(payload);
 284
 285     PacketResponseNG resp;
 286     WaitForResponse(CMD_LF_PSK_SIMULATE, &resp);
 287
 288     PrintAndLogEx(INFO, "Done!");
 289     if (resp.status != PM3_EOPABORTED) {
 290         return resp.status;
 291     }
 292     return PM3_SUCCESS;
 293 }
 294
 295 static int CmdIdteckReader(const char *Cmd) {
 296     CLIParserContext *ctx;
 297     CLIParserInit(&ctx, "lf idteck reader",
 298                   "read a Idteck tag",
 299                   "lf idteck reader -@   -> continuous reader mode"
 300                  );
 301
 302     void *argtable[] = {
 303         arg_param_begin,
 304         arg_lit0("@", NULL, "optional - continuous reader mode"),
 305         arg_param_end
 306     };
 307     CLIExecWithReturn(ctx, Cmd, argtable, true);
 308     bool cm = arg_get_lit(ctx, 1);
 309     CLIParserFree(ctx);
 310
 311     if (cm) {
 312         PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " to exit");
 313     }
 314
 315     do {
 316         lf_read(false, 5000);
 317         demodIdteck(NULL, !cm);
 318     } while (cm && !kbd_enter_pressed());
 319
 320     return PM3_SUCCESS;
 321 }
 322
 323 static command_t CommandTable[] = {
 324     {"help",    CmdHelp,         AlwaysAvailable, "This help"},
 325     {"demod",   CmdIdteckDemod,  AlwaysAvailable, "demodulate an Idteck tag from the GraphBuffer"},
 326     {"reader",  CmdIdteckReader, IfPm3Lf,         "attempt to read and extract tag data"},
 327     {"clone",   CmdIdteckClone,  IfPm3Lf,         "clone Idteck tag to T55x7 or Q5/T5555"},
 328     {"sim",     CmdIdteckSim,    IfPm3Lf,         "simulate Idteck tag"},
 329     {NULL, NULL, NULL, NULL}
 330 };
 331
 332 static int CmdHelp(const char *Cmd) {
 333     (void)Cmd; // Cmd is not used so far
 334     CmdsHelp(CommandTable);
 335     return PM3_SUCCESS;
 336 }
 337
 338 int CmdLFIdteck(const char *Cmd) {
 339     clearCommandBuffer();
 340     return CmdsParse(CommandTable, Cmd);
 341 }
 342
 343 // Find IDTEC PSK1, RF  Preamble == 0x4944544B, Demodsize 64bits
 344 int detectIdteck(uint8_t *dest, size_t *size) {
 345     //make sure buffer has data
 346     if (*size < 64 * 2) return -1;
 347
 348     if (getSignalProperties()->isnoise) return -2;
 349
 350     size_t start_idx = 0;
 351     //                    4           9           4           4           5           4           4           B
 352     uint8_t preamble[] = {0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 1, 1};
 353
 354     //preamble not found
 355     if (preambleSearch(dest, preamble, sizeof(preamble), size, &start_idx) == false)
 356         return -3;
 357
 358     // wrong demoded size
 359     if (*size != 64) {
 360         return -4;
 361     }
 362     return (int)start_idx;
 363 }