mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2025-08-24 07:05:40 -07:00
fix: clone a EM410x ID to Hitag S/8211 with clock
This commit is contained in:
douniwan5788
parent
541ef26c39
commit
c32fd53e5f
1 changed files with 62 additions and 33 deletions
|
|
@ -39,7 +39,7 @@
|
||||||
#include "generator.h"
|
#include "generator.h"
|
||||||
#include "cliparser.h"
|
#include "cliparser.h"
|
||||||
#include "cmdhw.h"
|
#include "cmdhw.h"
|
||||||
#include <hitag.h>
|
#include "hitag.h"
|
||||||
|
|
||||||
static uint64_t gs_em410xid = 0;
|
static uint64_t gs_em410xid = 0;
|
||||||
|
|
||||||
|
|
@ -675,7 +675,7 @@ static size_t concatbits(uint8_t *dst, size_t dstskip, const uint8_t *src, size_
|
||||||
static int CmdEM410xClone(const char *Cmd) {
|
static int CmdEM410xClone(const char *Cmd) {
|
||||||
CLIParserContext *ctx;
|
CLIParserContext *ctx;
|
||||||
CLIParserInit(&ctx, "lf em 410x clone",
|
CLIParserInit(&ctx, "lf em 410x clone",
|
||||||
"clone a EM410x ID to a T55x7, Q5/T5555 or EM4305/4469 tag.",
|
"clone a EM410x ID to a T55x7, Q5/T5555, EM4305/4469 or Hitag S/8211 tag.",
|
||||||
"lf em 410x clone --id 0F0368568B -> encode for T55x7 tag\n"
|
"lf em 410x clone --id 0F0368568B -> encode for T55x7 tag\n"
|
||||||
"lf em 410x clone --id 0F0368568B --q5 -> encode for Q5/T5555 tag\n"
|
"lf em 410x clone --id 0F0368568B --q5 -> encode for Q5/T5555 tag\n"
|
||||||
"lf em 410x clone --id 0F0368568B --em -> encode for EM4305/4469\n"
|
"lf em 410x clone --id 0F0368568B --em -> encode for EM4305/4469\n"
|
||||||
|
|
@ -710,10 +710,16 @@ static int CmdEM410xClone(const char *Cmd) {
|
||||||
return PM3_EINVARG;
|
return PM3_EINVARG;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (hs && IfPm3Hitag() == false) {
|
if (hs) {
|
||||||
|
if (IfPm3Hitag() == false) {
|
||||||
PrintAndLogEx(FAILED, "Device not compiled to support Hitag");
|
PrintAndLogEx(FAILED, "Device not compiled to support Hitag");
|
||||||
return PM3_EINVARG;
|
return PM3_EINVARG;
|
||||||
}
|
}
|
||||||
|
if (clk == 40) {
|
||||||
|
PrintAndLogEx(FAILED, "supported clock rates for Hitag are " _YELLOW_("16, 32, 64"));
|
||||||
|
return PM3_EINVARG;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
// Allowed clock rates: 16, 32, 40 and 64
|
// Allowed clock rates: 16, 32, 40 and 64
|
||||||
if ((clk != 16) && (clk != 32) && (clk != 64) && (clk != 40)) {
|
if ((clk != 16) && (clk != 32) && (clk != 64) && (clk != 40)) {
|
||||||
|
|
@ -722,8 +728,75 @@ static int CmdEM410xClone(const char *Cmd) {
|
||||||
}
|
}
|
||||||
|
|
||||||
uint64_t id = bytes_to_num(uid, uid_len);
|
uint64_t id = bytes_to_num(uid, uid_len);
|
||||||
PrintAndLogEx(SUCCESS, "Preparing to clone EM4102 to " _YELLOW_("%s") " tag with EM Tag ID " _GREEN_("%010" PRIX64) " (RF/%d)", q5 ? "Q5/T5555" : (em ? "EM4305/4469" : "T55x7"), id, clk);
|
PrintAndLogEx(SUCCESS, "Preparing to clone EM4102 to " _YELLOW_("%s") " tag with EM Tag ID " _GREEN_("%010" PRIX64) " (RF/%d)",
|
||||||
|
q5 ? "Q5/T5555" : (em ? "EM4305/4469" : (hs ? "Hitag S/8211" : "T55x7")), id, clk);
|
||||||
|
|
||||||
|
uint8_t data[HITAG_BLOCK_SIZE * 2] = {0xFF, 0x80}; // EM410X_HEADER 9 bits of one
|
||||||
|
uint32_t databits = 9;
|
||||||
|
uint8_t c_parity = 0;
|
||||||
|
|
||||||
|
for (int i = 36; i >= 0; i -= 4) {
|
||||||
|
uint8_t r_parity = 0;
|
||||||
|
uint8_t nibble = id >> i & 0xF;
|
||||||
|
|
||||||
|
databits = concatbits(data, databits, &nibble, 4, 4);
|
||||||
|
for (size_t j = 0; j < 4; j++) {
|
||||||
|
r_parity ^= nibble >> j & 1;
|
||||||
|
}
|
||||||
|
databits = concatbits(data, databits, &r_parity, 7, 1);
|
||||||
|
c_parity ^= nibble;
|
||||||
|
}
|
||||||
|
data[7] |= c_parity << 1;
|
||||||
|
|
||||||
|
PrintAndLogEx(INFO, "Encoded to %s", sprint_hex(data, sizeof(data)));
|
||||||
|
|
||||||
|
clearCommandBuffer();
|
||||||
|
PacketResponseNG resp;
|
||||||
|
|
||||||
|
if (hs) {
|
||||||
|
lf_hitag_data_t packet;
|
||||||
|
memset(&packet, 0, sizeof(packet));
|
||||||
|
|
||||||
|
for (size_t steps = 0; steps < 3; steps++) {
|
||||||
|
switch (steps) {
|
||||||
|
case 0:
|
||||||
|
packet.data[0] = 0xCA; //compatiable for 82xx, no impact on Hitag S
|
||||||
|
// clk -> TTFDR1 TTFDR0
|
||||||
|
// 32 -> 0x00 4 kBit/s
|
||||||
|
// 16 -> 0x10 8 kBit/s
|
||||||
|
// 64 -> 0x20 2 kBit/s
|
||||||
|
packet.data[1] = 0x04;
|
||||||
|
switch (clk) {
|
||||||
|
case 32: break;
|
||||||
|
case 16: packet.data[1] |= 0x10; break;
|
||||||
|
case 64: packet.data[1] |= 0x20; break;
|
||||||
|
}
|
||||||
|
packet.data[2] = 0;
|
||||||
|
packet.data[3] = 0; //TODO: keep PWDH0?
|
||||||
|
packet.page = 1;
|
||||||
|
break;
|
||||||
|
case 1:
|
||||||
|
memcpy(packet.data, &data[HITAG_BLOCK_SIZE * 0], HITAG_BLOCK_SIZE);
|
||||||
|
packet.page = 4;
|
||||||
|
break;
|
||||||
|
case 2:
|
||||||
|
memcpy(packet.data, &data[HITAG_BLOCK_SIZE * 1], HITAG_BLOCK_SIZE);
|
||||||
|
packet.page = 5;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
|
packet.cmd = WHTSF_PLAIN;
|
||||||
|
SendCommandNG(CMD_LF_HITAGS_WRITE, (uint8_t *)&packet, sizeof(packet));
|
||||||
|
if (WaitForResponseTimeout(CMD_LF_HITAGS_WRITE, &resp, 4000) == false) {
|
||||||
|
PrintAndLogEx(WARNING, "timeout while waiting for reply.");
|
||||||
|
return PM3_ETIMEOUT;
|
||||||
|
}
|
||||||
|
if (resp.status != PM3_SUCCESS) {
|
||||||
|
PrintAndLogEx(WARNING, "Something went wrong");
|
||||||
|
return resp.status;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
} else {
|
||||||
struct {
|
struct {
|
||||||
bool Q5;
|
bool Q5;
|
||||||
bool EM;
|
bool EM;
|
||||||
|
|
@ -740,50 +813,6 @@ static int CmdEM410xClone(const char *Cmd) {
|
||||||
payload.high = (uint32_t)(id >> 32);
|
payload.high = (uint32_t)(id >> 32);
|
||||||
payload.low = (uint32_t)id;
|
payload.low = (uint32_t)id;
|
||||||
|
|
||||||
|
|
||||||
uint8_t data[8] = {0xFF, 0x80}; // EM410X_HEADER 9 bits of one
|
|
||||||
uint32_t databits = 9;
|
|
||||||
uint8_t c_parity = 0;
|
|
||||||
|
|
||||||
for (int i = 36; i >= 0; i -= 4)
|
|
||||||
{
|
|
||||||
uint8_t r_parity = 0;
|
|
||||||
uint8_t nibble = id >> i & 0xF;
|
|
||||||
|
|
||||||
databits = concatbits(data, databits, &nibble, 4, 4);
|
|
||||||
for (size_t j = 0; j < 4; j++) {
|
|
||||||
r_parity ^= nibble >> j & 1;
|
|
||||||
}
|
|
||||||
databits = concatbits(data, databits, &r_parity, 7, 1);
|
|
||||||
c_parity ^= nibble;
|
|
||||||
}
|
|
||||||
data[7] |= c_parity << 1;
|
|
||||||
// print_hex_noascii_break(data, 8, 10);
|
|
||||||
|
|
||||||
clearCommandBuffer();
|
|
||||||
PacketResponseNG resp;
|
|
||||||
|
|
||||||
if (hs) {
|
|
||||||
lf_hitag_data_t packet;
|
|
||||||
memset(&packet, 0, sizeof(packet));
|
|
||||||
|
|
||||||
for (size_t page = 4; page <= 5; page++) {
|
|
||||||
packet.cmd = WHTSF_PLAIN;
|
|
||||||
packet.page = page;
|
|
||||||
memcpy(packet.data, &data[(page-4)*4], 4);
|
|
||||||
|
|
||||||
SendCommandNG(CMD_LF_HITAGS_WRITE, (uint8_t *)&packet, sizeof(packet));
|
|
||||||
if (WaitForResponseTimeout(CMD_LF_HITAGS_WRITE, &resp, 4000) == false)
|
|
||||||
{
|
|
||||||
PrintAndLogEx(WARNING, "timeout while waiting for reply.");
|
|
||||||
return PM3_ETIMEOUT;
|
|
||||||
}
|
|
||||||
if (resp.status != PM3_SUCCESS) {
|
|
||||||
PrintAndLogEx(WARNING, "Something went wrong");
|
|
||||||
return resp.status;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
SendCommandNG(CMD_LF_EM410X_CLONE, (uint8_t *)&payload, sizeof(payload));
|
SendCommandNG(CMD_LF_EM410X_CLONE, (uint8_t *)&payload, sizeof(payload));
|
||||||
WaitForResponse(CMD_LF_EM410X_CLONE, &resp);
|
WaitForResponse(CMD_LF_EM410X_CLONE, &resp);
|
||||||
}
|
}
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue