diff --git a/CHANGELOG.md b/CHANGELOG.md index a4898db8b..a1b430303 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file. This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log... ## [unreleased][unreleased] + - Added `lf em 4x50 eview` - show uploaded EM4x50 data in emul memory (@tharexde) - Fix `data rawdemod` parsing for psk2 and user defined clock (@cyberpunk-re) - Added `hf iclass encode` - encode a wiegand binary to a encrypted credential (@iceman1001) - Changed `recoverpk.py` - now tests more ECDSA curves (@doegox) diff --git a/armsrc/Standalone/lf_tharexde.c b/armsrc/Standalone/lf_tharexde.c deleted file mode 100644 index f5195513c..000000000 --- a/armsrc/Standalone/lf_tharexde.c +++ /dev/null @@ -1,359 +0,0 @@ -//----------------------------------------------------------------------------- -// Tharexde, 2020 -// -// This code is licensed to you under the terms of the GNU GPL, version 2 or, -// at your option, any later version. See the LICENSE.txt file for the text of -// the license. -//----------------------------------------------------------------------------- -// main code for EM4x50 simulator and collector aka THAREXDE -//----------------------------------------------------------------------------- -#include -#include "standalone.h" -#include "proxmark3_arm.h" -#include "appmain.h" -#include "BigBuf.h" -#include "fpgaloader.h" -#include "util.h" -#include "dbprint.h" -#include "spiffs.h" -#include "../em4x50.h" - -/* - * `lf_tharexde` simulates hardcoded words/blocks, reads words of standard read - * mode of EM4x50 tags and stores them in internal flash. - * It requires RDV4 hardware (for flash and battery). - * - * On entering stand-alone mode, this module will start reading/record EM4x50 data. - * Every found / collected data will be written/appended to the logfile in flash - * as a text string. - * - * LEDs: - * - LED A: simulating - * - LED B: reading / record - * - LED C: writing to flash - * - LED D: unmounting/sync'ing flash (normally < 100ms) - * - * To retrieve log file from flash: - * - * 1. mem spiffs dump o lf_em4x50collect.log f lf_em4x50collect.log - * Copies log file from flash to your client. - * - * 2. exit the Proxmark3 client - * - * 3. more lf_tharexdecollect.log - * - * This module emits debug strings during normal operation -- so try it out in - * the lab connected to PM3 client before taking it into the field. - * - * To delete the log file from flash: - * - * 1. mem spiffs remove lf_tharexdecollect.log - */ - -#define STATE_SIM 0 -#define STATE_READ 1 -#define STATE_BRUTE 2 -#define EM4X50_TAG_WORD 45 -#define EM4X50_PWD_SPEED 27 -#define LF_EM4X50SIMULATE_INPUTFILE "lf_em4x50simulate.eml" -#define LF_EM4X50COLLECT_LOGFILE "lf_em4x50collect.log" -#define LF_EM4X50BRUTE_INPUTFILE "lf_em4x50brute.eml" -#define LF_EM4X50BRUTE_LOGFILE "lf_em4x50brute.log" - -bool input_exists; -bool log_exists; - -static void LoadDataInstructions(const char *inputfile) { - Dbprintf(""); - Dbprintf("To load datafile into flash and display it:"); - Dbprintf(_YELLOW_("1.") " edit inputfile %s", inputfile); - Dbprintf(_YELLOW_("2.") " start proxmark3 client"); - Dbprintf(_YELLOW_("3.") " mem spiffs load f %s o %s", inputfile, inputfile); - Dbprintf(_YELLOW_("4.") " start standalone mode"); -} - -static void DownloadLogInstructions(const char *logfile) { - Dbprintf(""); - Dbprintf("To get the logfile from flash and display it:"); - Dbprintf(_YELLOW_("1.") " mem spiffs dump o %s f %s", logfile, logfile); - Dbprintf(_YELLOW_("2.") " exit proxmark3 client"); - Dbprintf(_YELLOW_("3.") " cat %s", logfile); -} - -static int get_input_data_from_file(uint32_t *words, char *inputfile) { - - size_t now = 0; - - if (exists_in_spiffs(inputfile)) { - - uint32_t size = size_in_spiffs(inputfile); - uint8_t *mem = BigBuf_malloc(size); - - Dbprintf(_YELLOW_("found input file %s"), inputfile); - - rdv40_spiffs_read_as_filetype(inputfile, mem, size, RDV40_SPIFFS_SAFETY_SAFE); - - now = size / 9; - for (int i = 0; i < now; i++) - for (int j = 0; j < 4; j++) - words[i] |= (hex2int(mem[2 * j + 9 * i]) << 4 | hex2int(mem[2 * j + 1 + 9 * i])) << ((3 - j) * 8); - - Dbprintf(_YELLOW_("read data from input file")); - } - - BigBuf_free(); - - return (now > 0) ? now : 0; -} - -static void append(const char *filename, uint8_t *entry, size_t entry_len) { - - LED_D_ON(); - if (log_exists == false) { - rdv40_spiffs_write(filename, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE); - log_exists = true; - } else { - rdv40_spiffs_append(filename, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE); - } - LED_D_OFF(); -} - -void ModInfo(void) { - DbpString(_YELLOW_(" LF EM4x50 sim/collector/bruteforce mode") " - a.k.a tharexde"); -} - -void RunMod(void) { - - bool state_change = true;//, password_found = false; - int pwd_found = false; - uint8_t state = STATE_SIM; - // declarations for simulating - uint32_t words[33] = {0x0}; - uint32_t pwd = 0x0; - uint32_t passwords[2] = {0x0}; - size_t now = 0; - // declarations for reading - int no_words = 0; - //uint32_t words[EM4X50_TAG_WORD]; - uint8_t entry[81]; - - rdv40_spiffs_lazy_mount(); - - StandAloneMode(); - Dbprintf(_YELLOW_("Standalone mode THAREXDE started")); - - for (;;) { - - WDT_HIT(); - if (data_available()) break; - - // press button - toggle between SIM, READ and BRUTE - // hold button - exit - int button_pressed = BUTTON_CLICKED(1000); - if (button_pressed == BUTTON_SINGLE_CLICK) { - - SpinUp(100); - - switch (state) { - - case STATE_SIM: - state = STATE_READ; - break; - case STATE_READ: - state = STATE_BRUTE; - break; - case STATE_BRUTE: - state = STATE_SIM; - break; - default: - break; - } - - state_change = true; - - } else if (button_pressed == BUTTON_HOLD) { - - SpinDown(100); - break; - } - - if (state == STATE_SIM) { - - if (state_change) { - - FpgaDownloadAndGo(FPGA_BITSTREAM_LF); - FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT); - FpgaSendCommand(FPGA_CMD_SET_DIVISOR, LF_DIVISOR_125); - - AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT | GPIO_SSC_CLK; - AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; - AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_CLK; - - LEDsoff(); - LED_A_ON(); - Dbprintf(""); - Dbprintf(_YELLOW_("switched to EM4x50 simulating mode")); - - now = get_input_data_from_file(words, LF_EM4X50SIMULATE_INPUTFILE); - if (now > 0) { - Dbprintf(_YELLOW_("simulating %i blocks"), now); - for (int i = 0; i < now; i++) - Dbprintf("%2i -> %lx", i + 1, words[i]); - - } else { - Dbprintf(_RED_("error in input data")); - } - - state_change = false; - } - - em4x50_sim_send_listen_window(); - for (int i = 0; i < now; i++) { - em4x50_sim_send_listen_window(); - em4x50_sim_send_word(words[i]); - } - - } else if (state == STATE_READ) { - - if (state_change) { - - LEDsoff(); - LED_B_ON(); - Dbprintf(""); - Dbprintf(_YELLOW_("switched to EM4x50 reading mode")); - - memset(entry, 0, sizeof(entry)); - memset(words, 0, sizeof(words)); - - log_exists = exists_in_spiffs(LF_EM4X50COLLECT_LOGFILE); - - state_change = false; - } - - no_words = em4x50_standalone_read(words); - - if (no_words > 0) { - - memset(entry, 0, sizeof(entry)); - - sprintf((char *)entry, "found new EM4x50 tag:"); - Dbprintf("%s", entry); - strcat((char *)entry, "\n"); - append(LF_EM4X50COLLECT_LOGFILE, entry, strlen((char *)entry)); - - for (int i = 0; i < no_words; i++) { - - sprintf((char *)entry, " %2i -> 0x%08"PRIx32"", i + 1, words[i]); - Dbprintf("%s", entry); - strcat((char *)entry, "\n"); - append(LF_EM4X50COLLECT_LOGFILE, entry, strlen((char *)entry)); - } - } - - } else if (state == STATE_BRUTE) { - - if (state_change) { - - LEDsoff(); - LED_C_ON(); - Dbprintf(""); - Dbprintf(_YELLOW_("switched to EM4x50 brute force mode")); - - log_exists = exists_in_spiffs(LF_EM4X50BRUTE_LOGFILE); - now = get_input_data_from_file(passwords, LF_EM4X50BRUTE_INPUTFILE); - - if (now == 2) { - - // print some information - int no_iter = passwords[1] - passwords[0] + 1; - int dur_s = no_iter / EM4X50_PWD_SPEED; - int dur_h = dur_s / 3600; - int dur_m = (dur_s - dur_h * 3600) / 60; - dur_s -= dur_h * 3600 + dur_m * 60; - - //iterprint = no_iter/10; - - Dbprintf(_YELLOW_("trying %i passwords in range [0x%08x, 0x%08x]"), - no_iter, passwords[0], passwords[1]); - Dbprintf(_YELLOW_("estimated duration: %ih%im%is"), - dur_h, dur_m, dur_s); - - } else { - Dbprintf(_RED_("error in input data")); - break; - } - - state_change = false; - } - - pwd_found = em4x50_standalone_brute(passwords[0], passwords[1], &pwd); - - if (pwd_found == PM3_ETIMEOUT) { - - // timeout -> no EM4x50 tag on reader? - Dbprintf(_YELLOW_("timeout - no EM4x50 tag detected")); - - } else if (pwd_found == true) { - - // password found -> write to logfile - sprintf((char *)entry, "password found: 0x%08"PRIx32, pwd); - Dbprintf(_YELLOW_("%s"), entry); - strcat((char *)entry, "\n"); - append(LF_EM4X50BRUTE_LOGFILE, entry, strlen((char *)entry)); - - break; - - } else { - - if (pwd == passwords[1] + 1) { - - // finished without success -> write to logfile - sprintf((char *)entry, "no password found"); - Dbprintf(_YELLOW_("%s"), entry); - strcat((char *)entry, "\n"); - append(LF_EM4X50BRUTE_LOGFILE, entry, strlen((char *)entry)); - - - } else { - - // stopped -> write to logfile - sprintf((char *)entry, "stopped search - last password: 0x%08"PRIx32, pwd); - Dbprintf(_YELLOW_("%s"), entry); - strcat((char *)entry, "\n"); - append(LF_EM4X50BRUTE_LOGFILE, entry, strlen((char *)entry)); - - // replace start password by last tested password in - // inputfile (spiffs) so that brute forcing process will - // be continued when envoking brute force mode again - sprintf((char *)entry, "%08"PRIx32"\n%08"PRIx32"\n", pwd, passwords[1]); - rdv40_spiffs_write(LF_EM4X50BRUTE_INPUTFILE, - entry, - strlen((char *)entry), - RDV40_SPIFFS_SAFETY_SAFE); - - } - - break; - } - } - } - - if (state == STATE_READ) { - DownloadLogInstructions(LF_EM4X50COLLECT_LOGFILE); - } else if (state == STATE_BRUTE) { - LoadDataInstructions(LF_EM4X50BRUTE_INPUTFILE); - DownloadLogInstructions(LF_EM4X50BRUTE_LOGFILE); - } else { - LoadDataInstructions(LF_EM4X50SIMULATE_INPUTFILE); - } - - LED_D_ON(); - rdv40_spiffs_lazy_unmount(); - LED_D_OFF(); - - FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); - LEDsoff(); - Dbprintf(""); - Dbprintf(_YELLOW_("[=] Standalone mode THAREXDE stopped")); - -} diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c index 8d977c91d..437afd956 100644 --- a/armsrc/em4x50.c +++ b/armsrc/em4x50.c @@ -45,6 +45,7 @@ #define EM4X50_TAG_TOLERANCE 8 #define EM4X50_TAG_WORD 45 +#define EM4X50_TAG_MAX_NO_BYTES 136 #define EM4X50_COMMAND_LOGIN 0x01 #define EM4X50_COMMAND_RESET 0x80 @@ -690,7 +691,7 @@ static bool em4x50_sim_send_byte_with_parity(uint8_t byte) { return true; } -bool em4x50_sim_send_word(uint32_t word) { +static bool em4x50_sim_send_word(uint32_t word) { uint8_t cparity = 0x00; @@ -721,7 +722,7 @@ bool em4x50_sim_send_word(uint32_t word) { return true; } -bool em4x50_sim_send_listen_window(void) { +static bool em4x50_sim_send_listen_window(void) { uint16_t check = 0; @@ -1015,8 +1016,7 @@ void em4x50_read(em4x50_data_t *etd) { LOW(GPIO_SSC_DOUT); lf_finalize(); - // iceman: this hardcoded 136 value.... - reply_ng(CMD_LF_EM4X50_READ, status, (uint8_t *)words, 136); + reply_ng(CMD_LF_EM4X50_READ, status, (uint8_t *)words, EM4X50_TAG_MAX_NO_BYTES); } // collects as much information as possible via selective read mode @@ -1041,8 +1041,7 @@ void em4x50_info(em4x50_data_t *etd) { lf_finalize(); - // iceman: this hardcoded 136 value.... - reply_ng(CMD_LF_EM4X50_INFO, status, (uint8_t *)words, 136); + reply_ng(CMD_LF_EM4X50_INFO, status, (uint8_t *)words, EM4X50_TAG_MAX_NO_BYTES); } // reads data that tag transmits "voluntarily" -> standard read mode @@ -1193,7 +1192,7 @@ void em4x50_write(em4x50_data_t *etd) { } lf_finalize(); - reply_ng(CMD_LF_EM4X50_WRITE, status, (uint8_t *)words, 136); + reply_ng(CMD_LF_EM4X50_WRITE, status, (uint8_t *)words, EM4X50_TAG_MAX_NO_BYTES); } // simple change of password diff --git a/armsrc/em4x50.h b/armsrc/em4x50.h index 12f0a64d8..9f9b38351 100644 --- a/armsrc/em4x50.h +++ b/armsrc/em4x50.h @@ -13,11 +13,6 @@ #include "../include/em4x50.h" -int em4x50_standalone_read(uint32_t *words); -int em4x50_standalone_brute(uint32_t start, uint32_t stop, uint32_t *pwd); -bool em4x50_sim_send_listen_window(void); -bool em4x50_sim_send_word(uint32_t word); - void em4x50_info(em4x50_data_t *etd); void em4x50_write(em4x50_data_t *etd); void em4x50_writepwd(em4x50_data_t *etd); diff --git a/client/src/cmdlfem4x50.c b/client/src/cmdlfem4x50.c index 09df8cfe6..2f415c32b 100644 --- a/client/src/cmdlfem4x50.c +++ b/client/src/cmdlfem4x50.c @@ -259,6 +259,48 @@ int CmdEM4x50ESave(const char *Cmd) { return PM3_SUCCESS; } +int CmdEM4x50EView(const char *Cmd) { + + CLIParserContext *ctx; + CLIParserInit(&ctx, "lf em 4x50 eview", + "Displays em4x50 content of emulator memory.", + "lf em 4x50 eview\n" + ); + + void *argtable[] = { + arg_param_begin, + arg_param_end + }; + + CLIExecWithReturn(ctx, Cmd, argtable, true); + CLIParserFree(ctx); + + // download emulator memory + PrintAndLogEx(SUCCESS, "Reading emulator memory..."); + uint8_t data[DUMP_FILESIZE] = {0x0}; + if (GetFromDevice(BIG_BUF_EML, data, DUMP_FILESIZE, 0, NULL, 0, NULL, 2500, false) == false) { + PrintAndLogEx(WARNING, "Fail, transfer from device time-out"); + return PM3_ETIMEOUT; + } + + // valid em4x50 data? + uint32_t serial = bytes_to_num(data + 4 * EM4X50_DEVICE_SERIAL, 4); + uint32_t device_id = bytes_to_num(data + 4 * EM4X50_DEVICE_ID, 4); + if (serial == device_id) { + PrintAndLogEx(WARNING, "No valid em4x50 data in emulator memory."); + return PM3_ENODATA; + } + + em4x50_word_t words[EM4X50_NO_WORDS]; + for (int i = 0; i < EM4X50_NO_WORDS; i++) { + memcpy(words[i].byte, data + i * 4, 4); + } + print_result(words, 0, EM4X50_NO_WORDS - 1); + PrintAndLogEx(NORMAL, ""); + + return PM3_SUCCESS; +} + int CmdEM4x50Login(const char *Cmd) { CLIParserContext *ctx; CLIParserInit(&ctx, "lf em 4x50 login", @@ -1123,8 +1165,9 @@ static command_t CommandTable[] = { {"reader", CmdEM4x50Reader, IfPm3EM4x50, "show standard read mode data of EM4x50"}, {"restore", CmdEM4x50Restore, IfPm3EM4x50, "restore EM4x50 dump to tag"}, {"sim", CmdEM4x50Sim, IfPm3EM4x50, "simulate EM4x50 tag"}, - {"eload", CmdEM4x50ELoad, IfPm3EM4x50, "upload dump of EM4x50 to flash memory"}, - {"esave", CmdEM4x50ESave, IfPm3EM4x50, "save flash memory to file"}, + {"eload", CmdEM4x50ELoad, IfPm3EM4x50, "upload dump of EM4x50 to emulator memory"}, + {"esave", CmdEM4x50ESave, IfPm3EM4x50, "save emulator memory to file"}, + {"eview", CmdEM4x50EView, IfPm3EM4x50, "view EM4x50 content in emulator memory"}, {NULL, NULL, NULL, NULL} }; diff --git a/client/src/cmdlfem4x50.h b/client/src/cmdlfem4x50.h index dab84ba6c..0d5c04bc6 100644 --- a/client/src/cmdlfem4x50.h +++ b/client/src/cmdlfem4x50.h @@ -33,5 +33,6 @@ int CmdEM4x50Reader(const char *Cmd); int CmdEM4x50ELoad(const char *Cmd); int CmdEM4x50ESave(const char *Cmd); int CmdEM4x50Chk(const char *Cmd); +int CmdEM4x50EView(const char *Cmd); #endif