client/src/cmdlfvisa2000.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) Proxmark3 contributors. See AUTHORS.md for details.
   3 //
   4 // This program is free software: you can redistribute it and/or modify
   5 // it under the terms of the GNU General Public License as published by
   6 // the Free Software Foundation, either version 3 of the License, or
   7 // (at your option) any later version.
   8 //
   9 // This program is distributed in the hope that it will be useful,
  10 // but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12 // GNU General Public License for more details.
  13 //
  14 // See LICENSE.txt for the text of the license.
  15 //-----------------------------------------------------------------------------
  16 // Low frequency visa 2000 tag commands
  17 // by iceman
  18 // ASK/Manchester, RF/64, STT, 96 bits (complete)
  19 //-----------------------------------------------------------------------------
  20
  21 #include "cmdlfvisa2000.h"
  22 #include <string.h>
  23 #include <ctype.h>
  24 #include <stdlib.h>
  25 #include <inttypes.h>
  26 #include <stdio.h>
  27 #include "commonutil.h"    // ARRAYLEN
  28 #include "common.h"
  29 #include "cmdparser.h"     // command_t
  30 #include "comms.h"
  31 #include "ui.h"
  32 #include "graph.h"
  33 #include "cmddata.h"
  34 #include "cmdlf.h"
  35 #include "protocols.h"     // for T55xx config register definitions
  36 #include "lfdemod.h"       // parityTest
  37 #include "cmdlft55xx.h"    // write verify
  38 #include "cmdlfem4x05.h"   //
  39 #include "cliparser.h"
  40
  41 #ifndef VISA2k_BL0CK1
  42 #define VISA2k_BL0CK1 0x56495332
  43 #endif
  44
  45 static int CmdHelp(const char *Cmd);
  46
  47 static uint8_t visa_chksum(uint32_t id) {
  48     uint8_t sum = 0;
  49     for (uint8_t i = 0; i < 32; i += 4)
  50         sum ^= (id >> i) & 0xF;
  51     return sum & 0xF;
  52 }
  53
  54 static uint8_t visa_parity(uint32_t id) {
  55     // 4bit parity LUT
  56     const uint8_t par_lut[] = {
  57         0, 1, 1, 0, 1, 0, 0, 1,
  58         1, 0, 0, 1, 0, 1, 1, 0
  59     };
  60
  61     uint8_t par = 0;
  62     par |= par_lut[(id >> 28) & 0xF ] << 7;
  63     par |= par_lut[(id >> 24) & 0xF ] << 6;
  64     par |= par_lut[(id >> 20) & 0xF ] << 5;
  65     par |= par_lut[(id >> 16) & 0xF ] << 4;
  66     par |= par_lut[(id >> 12) & 0xF ] << 3;
  67     par |= par_lut[(id >>  8) & 0xF ] << 2;
  68     par |= par_lut[(id >>  4) & 0xF ] << 1;
  69     par |= par_lut[(id & 0xF) ];
  70     return par;
  71 }
  72
  73 /**
  74 *
  75 * 56495332 00096ebd 00000077 —> tag id 618173
  76 * aaaaaaaa iiiiiiii -----ppc
  77 *
  78 * a = fixed value  ascii 'VIS2'
  79 * i = card id
  80 * p = even parity bit for each nibble in card id.
  81 * c = checksum  (xor of card id)
  82 *
  83 **/
  84 //see ASKDemod for what args are accepted
  85 int demodVisa2k(bool verbose) {
  86     (void) verbose; // unused so far
  87     buffer_savestate_t saveState = save_bufferS32(g_GraphBuffer, g_GraphTraceLen);
  88     saveState.offset = g_GridOffset;
  89
  90     //CmdAskEdgeDetect("");
  91
  92     //ASK / Manchester
  93     bool st = true;
  94     if (ASKDemod_ext(64, 0, 0, 0, false, false, false, 1, &st) != PM3_SUCCESS) {
  95         PrintAndLogEx(DEBUG, "DEBUG: Error - Visa2k: ASK/Manchester Demod failed");
  96         restore_bufferS32(saveState, g_GraphBuffer);
  97         g_GridOffset = saveState.offset;
  98         return PM3_ESOFT;
  99     }
 100     size_t size = g_DemodBufferLen;
 101     int ans = detectVisa2k(g_DemodBuffer, &size);
 102     if (ans < 0) {
 103         if (ans == -1)
 104             PrintAndLogEx(DEBUG, "DEBUG: Error - Visa2k: too few bits found");
 105         else if (ans == -2)
 106             PrintAndLogEx(DEBUG, "DEBUG: Error - Visa2k: preamble not found");
 107         else if (ans == -3)
 108             PrintAndLogEx(DEBUG, "DEBUG: Error - Visa2k: Size not correct: %zu", size);
 109         else
 110             PrintAndLogEx(DEBUG, "DEBUG: Error - Visa2k: ans: %d", ans);
 111
 112         restore_bufferS32(saveState, g_GraphBuffer);
 113         g_GridOffset = saveState.offset;
 114         return PM3_ESOFT;
 115     }
 116     setDemodBuff(g_DemodBuffer, 96, ans);
 117     setClockGrid(g_DemodClock, g_DemodStartIdx + (ans * g_DemodClock));
 118
 119     //got a good demod
 120     uint32_t raw1 = bytebits_to_byte(g_DemodBuffer, 32);
 121     uint32_t raw2 = bytebits_to_byte(g_DemodBuffer + 32, 32);
 122     uint32_t raw3 = bytebits_to_byte(g_DemodBuffer + 64, 32);
 123
 124     // chksum
 125     uint8_t calc = visa_chksum(raw2);
 126     uint8_t chk = raw3 & 0xF;
 127
 128     // test checksums
 129     if (chk != calc) {
 130         PrintAndLogEx(DEBUG, "DEBUG: error: Visa2000 checksum (%s) %x - %x\n", _RED_("fail"), chk, calc);
 131         restore_bufferS32(saveState, g_GraphBuffer);
 132         g_GridOffset = saveState.offset;
 133         return PM3_ESOFT;
 134     }
 135     // parity
 136     uint8_t calc_par = visa_parity(raw2);
 137     uint8_t chk_par = (raw3 & 0xFF0) >> 4;
 138     if (calc_par != chk_par) {
 139         PrintAndLogEx(DEBUG, "DEBUG: error: Visa2000 parity (%s) %x - %x\n", _RED_("fail"), chk_par, calc_par);
 140         restore_bufferS32(saveState, g_GraphBuffer);
 141         g_GridOffset = saveState.offset;
 142         return PM3_ESOFT;
 143     }
 144     PrintAndLogEx(SUCCESS, "Visa2000 - Card " _GREEN_("%u") ", Raw: %08X%08X%08X", raw2,  raw1, raw2, raw3);
 145     return PM3_SUCCESS;
 146 }
 147
 148 static int CmdVisa2kDemod(const char *Cmd) {
 149     CLIParserContext *ctx;
 150     CLIParserInit(&ctx, "lf visa2000 demod",
 151                   "Try to find visa2000 preamble, if found decode / descramble data",
 152                   "lf visa2000 demod"
 153                  );
 154
 155     void *argtable[] = {
 156         arg_param_begin,
 157         arg_param_end
 158     };
 159     CLIExecWithReturn(ctx, Cmd, argtable, true);
 160     CLIParserFree(ctx);
 161     return demodVisa2k(true);
 162 }
 163
 164 // 64*96*2=12288 samples just in case we just missed the first preamble we can still catch 2 of them
 165 static int CmdVisa2kReader(const char *Cmd) {
 166     CLIParserContext *ctx;
 167     CLIParserInit(&ctx, "lf visa2000 reader",
 168                   "read a visa2000 tag",
 169                   "lf visa2000 reader -@   -> continuous reader mode"
 170                  );
 171
 172     void *argtable[] = {
 173         arg_param_begin,
 174         arg_lit0("@", NULL, "optional - continuous reader mode"),
 175         arg_param_end
 176     };
 177     CLIExecWithReturn(ctx, Cmd, argtable, true);
 178     bool cm = arg_get_lit(ctx, 1);
 179     CLIParserFree(ctx);
 180
 181     if (cm) {
 182         PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " to exit");
 183     }
 184
 185     do {
 186         lf_read(false, 20000);
 187         demodVisa2k(!cm);
 188     } while (cm && !kbd_enter_pressed());
 189     return PM3_SUCCESS;
 190 }
 191
 192 static int CmdVisa2kClone(const char *Cmd) {
 193
 194     CLIParserContext *ctx;
 195     CLIParserInit(&ctx, "lf visa2000 clone",
 196                   "clone a Visa2000 tag to a T55x7, Q5/T5555 or EM4305/4469 tag.",
 197                   "lf visa2000 clone --cn 112233           -> encode for T55x7 tag\n"
 198                   "lf visa2000 clone --cn 112233 --q5      -> encode for Q5/T5555 tag\n"
 199                   "lf visa2000 clone --cn 112233 --em      -> encode for EM4305/4469"
 200                  );
 201
 202     void *argtable[] = {
 203         arg_param_begin,
 204         arg_u64_1(NULL, "cn", "<dec>", "Visa2k card ID"),
 205         arg_lit0(NULL, "q5", "optional - specify writing to Q5/T5555 tag"),
 206         arg_lit0(NULL, "em", "optional - specify writing to EM4305/4469 tag"),
 207         arg_param_end
 208     };
 209     CLIExecWithReturn(ctx, Cmd, argtable, false);
 210
 211     uint32_t id = arg_get_u32_def(ctx, 1, 0);
 212     bool q5 = arg_get_lit(ctx, 2);
 213     bool em = arg_get_lit(ctx, 3);
 214     CLIParserFree(ctx);
 215
 216     if (q5 && em) {
 217         PrintAndLogEx(FAILED, "Can't specify both Q5 and EM4305 at the same time");
 218         return PM3_EINVARG;
 219     }
 220
 221     uint32_t blocks[4] = {T55x7_MODULATION_MANCHESTER | T55x7_BITRATE_RF_64 | T55x7_ST_TERMINATOR | 3 << T55x7_MAXBLOCK_SHIFT, VISA2k_BL0CK1, 0};
 222     char cardtype[16] = {"T55x7"};
 223     // Q5
 224     if (q5) {
 225         blocks[0] = T5555_FIXED | T5555_MODULATION_MANCHESTER | T5555_SET_BITRATE(64) | T5555_ST_TERMINATOR | 3 << T5555_MAXBLOCK_SHIFT;
 226         snprintf(cardtype, sizeof(cardtype), "Q5/T5555");
 227     }
 228
 229     // EM4305
 230     if (em) {
 231         blocks[0] = EM4305_VISA2000_CONFIG_BLOCK;
 232         snprintf(cardtype, sizeof(cardtype), "EM4305/4469");
 233     }
 234
 235     blocks[2] = id;
 236     blocks[3] = (visa_parity(id) << 4) | visa_chksum(id);
 237
 238     PrintAndLogEx(INFO, "Preparing to clone Visa2000 to " _YELLOW_("%s") " with CardId: " _GREEN_("%"PRIu32), cardtype, id);
 239     print_blocks(blocks,  ARRAYLEN(blocks));
 240
 241     int res;
 242     if (em) {
 243         res = em4x05_clone_tag(blocks, ARRAYLEN(blocks), 0, false);
 244     } else {
 245         res = clone_t55xx_tag(blocks, ARRAYLEN(blocks));
 246     }
 247     PrintAndLogEx(SUCCESS, "Done!");
 248     PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf visa2000 reader`") " to verify");
 249     return res;
 250 }
 251
 252 static int CmdVisa2kSim(const char *Cmd) {
 253
 254     CLIParserContext *ctx;
 255     CLIParserInit(&ctx, "lf visa2000 sim",
 256                   "Enables simulation of visa2k card with specified card number.\n"
 257                   "Simulation runs until the button is pressed or another USB command is issued.\n",
 258                   "lf visa2000 sim --cn 1337"
 259                  );
 260
 261     void *argtable[] = {
 262         arg_param_begin,
 263         arg_u64_1(NULL, "cn", "<dec>", "Visa2k card ID"),
 264         arg_param_end
 265     };
 266     CLIExecWithReturn(ctx, Cmd, argtable, false);
 267     uint32_t id = arg_get_u32_def(ctx, 1, 0);
 268     CLIParserFree(ctx);
 269
 270     PrintAndLogEx(SUCCESS, "Simulating Visa2000 - CardId:" _YELLOW_("%u"), id);
 271
 272     uint32_t blocks[3] = { VISA2k_BL0CK1, id, (visa_parity(id) << 4) | visa_chksum(id) };
 273
 274     uint8_t bs[96];
 275     for (int i = 0; i < 3; ++i)
 276         num_to_bytebits(blocks[i], 32, bs + i * 32);
 277
 278     lf_asksim_t *payload = calloc(1, sizeof(lf_asksim_t) + sizeof(bs));
 279     payload->encoding =  1;
 280     payload->invert = 0;
 281     payload->separator = 1;
 282     payload->clock = 64;
 283     memcpy(payload->data, bs, sizeof(bs));
 284
 285     clearCommandBuffer();
 286     SendCommandNG(CMD_LF_ASK_SIMULATE, (uint8_t *)payload,  sizeof(lf_asksim_t) + sizeof(bs));
 287     free(payload);
 288
 289     PacketResponseNG resp;
 290     WaitForResponse(CMD_LF_ASK_SIMULATE, &resp);
 291
 292     PrintAndLogEx(INFO, "Done!");
 293     if (resp.status != PM3_EOPABORTED) {
 294         return resp.status;
 295     }
 296     return PM3_SUCCESS;
 297 }
 298
 299 static command_t CommandTable[] = {
 300     {"help",    CmdHelp,         AlwaysAvailable, "This help"},
 301     {"demod",   CmdVisa2kDemod,  AlwaysAvailable, "demodulate an VISA2000 tag from the GraphBuffer"},
 302     {"reader",  CmdVisa2kReader, IfPm3Lf,         "attempt to read and extract tag data"},
 303     {"clone",   CmdVisa2kClone,  IfPm3Lf,         "clone Visa2000 tag to T55x7, Q5/T5555 or EM4305/4469"},
 304     {"sim",     CmdVisa2kSim,    IfPm3Lf,         "simulate Visa2000 tag"},
 305     {NULL, NULL, NULL, NULL}
 306 };
 307
 308 static int CmdHelp(const char *Cmd) {
 309     (void)Cmd; // Cmd is not used so far
 310     CmdsHelp(CommandTable);
 311     return PM3_SUCCESS;
 312 }
 313
 314 int CmdLFVisa2k(const char *Cmd) {
 315     clearCommandBuffer();
 316     return CmdsParse(CommandTable, Cmd);
 317 }
 318
 319 // by iceman
 320 // find Visa2000 preamble in already demoded data
 321 int detectVisa2k(uint8_t *dest, size_t *size) {
 322     if (*size < 96) return -1; //make sure buffer has data
 323     size_t startIdx = 0;
 324     uint8_t preamble[] = {0, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0};
 325     if (!preambleSearch(dest, preamble, sizeof(preamble), size, &startIdx))
 326         return -2; //preamble not found
 327     if (*size != 96) return -3; //wrong demoded size
 328     //return start position
 329     return (int)startIdx;
 330 }
 331
 332