From f317e3247a7f96ee68ac62b6201a32a6c66918a4 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Mon, 5 Aug 2019 17:43:53 +0200 Subject: [PATCH] chg: 'lf nedap' - decoding / encoding of Nedap. (anon) --- client/cmdlfnedap.c | 683 +++++++++++++++++++++++++----------------- client/cmdlfnoralsy.c | 9 +- 2 files changed, 417 insertions(+), 275 deletions(-) diff --git a/client/cmdlfnedap.c b/client/cmdlfnedap.c index c8a851ea6..d4cca1a30 100644 --- a/client/cmdlfnedap.c +++ b/client/cmdlfnedap.c @@ -8,137 +8,260 @@ //----------------------------------------------------------------------------- #include "cmdlfnedap.h" + +#define FIXED_71 0x71 +#define FIXED_40 0x40 +#define UNKNOWN_A 0x00 +#define UNKNOWN_B 0x00 + static int CmdHelp(const char *Cmd); -/* -static int usage_lf_nedap_clone(void) { - PrintAndLogEx(NORMAL, "clone a NEDAP tag to a T55x7 tag."); +static int usage_lf_nedap_gen(void) { + PrintAndLogEx(NORMAL, "generate Nedap bitstream in DemodBuffer"); PrintAndLogEx(NORMAL, ""); - PrintAndLogEx(NORMAL, "Usage: lf nedap clone [h] "); - PrintAndLogEx(NORMAL, "Options:"); - PrintAndLogEx(NORMAL, " h : This help"); - PrintAndLogEx(NORMAL, " : 24-bit value card number"); -// PrintAndLogEx(NORMAL, " Q5 : optional - clone to Q5 (T5555) instead of T55x7 chip"); - PrintAndLogEx(NORMAL, ""); - PrintAndLogEx(NORMAL, "Examples:"); - PrintAndLogEx(NORMAL, " lf nedap clone 112233"); - return PM3_SUCCESS; -} -*/ - -static int usage_lf_nedap_sim(void) { - PrintAndLogEx(NORMAL, "Enables simulation of NEDAP card with specified card number."); - PrintAndLogEx(NORMAL, "Simulation runs until the button is pressed or another USB command is issued."); - PrintAndLogEx(NORMAL, ""); - PrintAndLogEx(NORMAL, "Usage: lf nedap sim [h] "); + PrintAndLogEx(NORMAL, "Usage: lf nedap generate [h] [s ] c i [l]"); PrintAndLogEx(NORMAL, "Options:"); PrintAndLogEx(NORMAL, " h : This help"); - PrintAndLogEx(NORMAL, " : 24-bit value card number"); + PrintAndLogEx(NORMAL, " s : optional, default=5"); + PrintAndLogEx(NORMAL, " c : customerCode"); + PrintAndLogEx(NORMAL, " i : ID (max 99999)"); + PrintAndLogEx(NORMAL, " l : optional - long (128), default to short (64)"); PrintAndLogEx(NORMAL, ""); PrintAndLogEx(NORMAL, "Examples:"); - PrintAndLogEx(NORMAL, " lf nedap sim 112233"); + PrintAndLogEx(NORMAL, " lf nedap generate s 1 c 123 i 112233"); return PM3_SUCCESS; } +static int usage_lf_nedap_clone(void) { + PrintAndLogEx(NORMAL, "clone a Nedap tag to a T55x7 tag."); + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(NORMAL, "Usage: lf nedap clone [h] [s ] c i [l]"); + PrintAndLogEx(NORMAL, "Options:"); + PrintAndLogEx(NORMAL, " h : This help"); + PrintAndLogEx(NORMAL, " s : optional, default=5"); + PrintAndLogEx(NORMAL, " c : customerCode"); + PrintAndLogEx(NORMAL, " i : ID (max 99999)"); + PrintAndLogEx(NORMAL, " l : optional - long (128), default to short (64)"); +// PrintAndLogEx(NORMAL, " Q5 : optional - clone to Q5 (T5555) instead of T55x7 chip"); + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(NORMAL, "Examples:"); + PrintAndLogEx(NORMAL, " lf nedap clone s 1 c 123 i 112233"); + return PM3_SUCCESS; +} + +static int usage_lf_nedap_sim(void) { + PrintAndLogEx(NORMAL, "simulate Nedap card."); + PrintAndLogEx(NORMAL, "Simulation runs until the button is pressed or another USB command is issued."); + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(NORMAL, "Usage: lf nedap sim [h] [s ] c i [l]"); + PrintAndLogEx(NORMAL, "Options:"); + PrintAndLogEx(NORMAL, " h : This help"); + PrintAndLogEx(NORMAL, " s : subtype, default=5"); + PrintAndLogEx(NORMAL, " c : customerCode"); + PrintAndLogEx(NORMAL, " i : ID (max 99999)"); + PrintAndLogEx(NORMAL, " l : long (128), default to short (64)"); + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(NORMAL, "Examples:"); +// TODO proper example? + PrintAndLogEx(NORMAL, " lf nedap sim s 1 c 7 i 1337"); + return PM3_SUCCESS; +} + +const uint8_t translateTable[10] = {8, 2, 1, 12, 4, 5, 10, 13, 0, 9}; +const uint8_t invTranslateTable[16] = {8, 2, 1, 0xff, 4, 5, 0xff, 0xff, 0, 9, 6, 0xff, 3, 7, 0xff, 0xff}; +const uint8_t preamble[] = {1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0}; // zero inside + +static inline uint32_t bitcount(uint32_t a) { +#if defined __GNUC__ + return __builtin_popcountl(a); +#else + a = a - ((a >> 1) & 0x55555555); + a = (a & 0x33333333) + ((a >> 2) & 0x33333333); + return (((a + (a >> 4)) & 0x0f0f0f0f) * 0x01010101) >> 24; +#endif +} + +static uint8_t isEven_64_63(const uint8_t *data) { // 8 + return (bitcount(*(uint32_t *) data) + (bitcount((*(uint32_t *)(data + 4)) & 0xfeffffff))) & 1; +} + //NEDAP demod - ASK/Biphase (or Diphase), RF/64 with preamble of 1111111110 (always a 128 bit data stream) -//print NEDAP Prox ID, encoding, encrypted ID, static int CmdLFNedapDemod(const char *Cmd) { (void)Cmd; // Cmd is not used so far - //raw ask demod no start bit finding just get binary from wave + + uint8_t data[16], buffer[7], r0, r1, r2, r3, r4, r5, idxC1, idxC2, idxC3, idxC4, idxC5, fixed0, fixed1, unk1, unk2, subtype; // 4 bits + size_t size, offset = 0; + uint16_t checksum, customerCode; // 12 bits + uint32_t badgeId; // max 99999 + if (ASKbiphaseDemod("0 64 1 0", false) != PM3_SUCCESS) { - if (g_debugMode) PrintAndLogEx(DEBUG, "DEBUG: Error - Nedap ASKbiphaseDemod failed"); + if (g_debugMode) PrintAndLogEx(DEBUG, "DEBUG: Error - NEDAP: ASK/Biphase Demod failed"); return PM3_ESOFT; } - size_t size = DemodBufferLen; - int idx = detectNedap(DemodBuffer, &size); - if (idx < 0) { - if (g_debugMode) { - // if (idx == -5) - // PrintAndLogEx(DEBUG, "DEBUG: Error - not enough samples"); - // else if (idx == -1) - // PrintAndLogEx(DEBUG, "DEBUG: Error - only noise found"); - // else if (idx == -2) - // PrintAndLogEx(DEBUG, "DEBUG: Error - problem during ASK/Biphase demod"); - if (idx == -3) - PrintAndLogEx(DEBUG, "DEBUG: Error - Nedap Size not correct: %d", size); - else if (idx == -4) - PrintAndLogEx(DEBUG, "DEBUG: Error - Nedap preamble not found"); - else - PrintAndLogEx(DEBUG, "DEBUG: Error - Nedap idx: %d", idx); + + size = DemodBufferLen; + if (!preambleSearch(DemodBuffer, (uint8_t *) preamble, sizeof(preamble), &size, &offset)) { + PrintAndLogEx(DEBUG, "DEBUG: Error - NEDAP: preamble not found"); + return PM3_ESOFT; + } + + // set plot + setDemodBuff(DemodBuffer, size, offset); + setClockGrid(g_DemodClock, g_DemodStartIdx + (g_DemodClock * offset)); + + // sanity checks + if ((size != 128) && (size != 64)) { + PrintAndLogEx(DEBUG, "DEBUG: Error - NEDAP: Size not correct: %d", size); + return PM3_ESOFT; + } + + if (bits_to_array(DemodBuffer, size, data) != PM3_SUCCESS) { + PrintAndLogEx(DEBUG, "DEBUG: Error - NEDAP: bits_to_array error\n"); + return PM3_ESOFT; + } + + + int ret = PM3_SUCCESS; + + // first part + + // parity 1 check + if (isEven_64_63(data) != (data[7] & 0x01)) { + PrintAndLogEx(ERR, "Bad parity (%1u)", data[7] & 0x01); + ret = PM3_ESOFT; + } + + // header 1 check + // (1111111110 0 -- zero inside) + if ((data[0] != 0xFF) && ((data[1] & 0xE0) != 0x80)) { + PrintAndLogEx(ERR, "Bad header"); + ret = PM3_ESOFT; + } + + buffer[0] = (data[0] << 7) | (data[1] >> 1); + buffer[1] = (data[1] << 7) | (data[2] >> 1); + buffer[2] = (data[2] << 7) | (data[3] >> 1); + buffer[3] = ((data[4] & 0x1e) << 3) | ((data[5] & 0x1e) >> 1); + buffer[4] = ((data[6] & 0x1e) << 3) | ((data[7] & 0x1e) >> 1); + + // CHECKSUM + init_table(CRC_XMODEM); + checksum = crc16_xmodem(buffer, 5); + + buffer[6] = (data[3] << 7) | ((data[4] & 0xe0) >> 1) | ((data[4] & 0x01) << 3) | ((data[5] & 0xe0) >> 5); + buffer[5] = (data[5] << 7) | ((data[6] & 0xe0) >> 1) | ((data[6] & 0x01) << 3) | ((data[7] & 0xe0) >> 5); + + bool isValid = (checksum == *(uint16_t *)(buffer + 5)); + + subtype = (data[1] & 0x1e) >> 1; + customerCode = ((data[1] & 0x01) << 11) | (data[2] << 3) | ((data[3] & 0xe0) >> 5); + + if ( isValid == false ) { + PrintAndLogEx(ERR, "Checksum : %s (calc 0x%04X != 0x%04X)", _RED_("failed"), checksum, *(uint16_t *)(buffer + 5)); + ret = PM3_ESOFT; + } + + idxC1 = invTranslateTable[(data[3] & 0x1e) >> 1]; + idxC2 = invTranslateTable[(data[4] & 0x1e) >> 1]; + idxC3 = invTranslateTable[(data[5] & 0x1e) >> 1]; + idxC4 = invTranslateTable[(data[6] & 0x1e) >> 1]; + idxC5 = invTranslateTable[(data[7] & 0x1e) >> 1]; + + // validation + if ((idxC1 != 0xFF) && (idxC2 != 0xFF) && (idxC3 != 0xFF) && (idxC4 != 0xFF) && (idxC5 != 0xFF)) { + r1 = idxC1; + r2 = ((10 + idxC2) - (idxC1 + 1)) % 10; + r3 = ((10 + idxC3) - (idxC2 + 1)) % 10; + r4 = ((10 + idxC4) - (idxC3 + 1)) % 10; + r5 = ((10 + idxC5) - (idxC4 + 1)) % 10; + + badgeId = r1 * 10000 + r2 * 1000 + r3 * 100 + r4 * 10 + r5; + + PrintAndLogEx(SUCCESS, "NEDAP Tag Found: Card ID "_YELLOW_("%05u")" subtype: "_YELLOW_("%1u")" customer code: "_YELLOW_("%03x"), badgeId, subtype, customerCode); + PrintAndLogEx(SUCCESS, "Checksum is %s (0x%04X)", _GREEN_("OK"), checksum ); + PrintAndLogEx(SUCCESS, "Raw: %s", sprint_hex(data, size/8)); + } else { + PrintAndLogEx(ERR, "Invalid idx (1:%02x - 2:%02x - 3:%02x - 4:%02x - 5:%02x)", idxC1, idxC2, idxC3, idxC4, idxC5); + ret = PM3_ESOFT; + } + + if (size > 64) { + // second part + PrintAndLogEx(DEBUG, "NEDAP Tag, second part found"); + + if (isEven_64_63(data + 8) != (data[15] & 0x01)) { + PrintAndLogEx(ERR, "Bad parity (%1u)", data[15] & 0x01); + return ret; + } + + // validation + if ( (data[8] & 0x80) + && (data[9] & 0x40) + && (data[10] & 0x20) + && (data[11] & 0x10) + && (data[12] & 0x08) + && (data[13] & 0x04) + && (data[14] & 0x02)) { + PrintAndLogEx(ERR, "Bad zeros"); + return ret; + } + + // + r4 = (data[8] >> 3) & 0x0F; + r5 = ((data[8] << 1) & 0x0F) | (data[9] >> 7); + r2 = (data[9] >> 2) & 0x0F; + r3 = ((data[9] << 2) & 0x0F) | (data[10] >> 6); + r0 = ((data[10] >> 1) & 0x0F); + r1 = ((data[10] << 3) & 0x0F) | (data[11] >> 5); + + fixed0 = ((data[11] << 4) & 0xF0) | (data[12] >> 4); + fixed1 = ((data[12] << 5) & 0xE0) | (data[13] >> 3); + + unk1 = ((data[13] << 6) & 0xC0) | (data[14] >> 2); + unk2 = ((data[14] << 7) & 0xC0) | (data[15] >> 1); + + // validation 2 + if (!r0 && (r1 < 10) && (r2 < 10) && (r3 < 10) && (r4 < 10) && (r5 < 10)) { + + badgeId = r1 * 10000 + r2 * 1000 + r3 * 100 + r4 * 10 + r5; + PrintAndLogEx(SUCCESS, "Second Card Id " _YELLOW_("%05u"), badgeId); + + if ((fixed0 == FIXED_71) && (fixed1 == FIXED_40)) + PrintAndLogEx(DEBUG, "Fixed part {0 = 0x%02x, 1 = 0x%02x}", fixed0, fixed1); + else + PrintAndLogEx(DEBUG, "Bad fixed: {0 = 0x%02x (%0x02x), 1 = 0x%02x (%0x02x)}", fixed0, FIXED_71, fixed1, FIXED_40); + + PrintAndLogEx(DEBUG, "Unknown part {1 = 0x%02x, 2 = 0x%02x}", unk1, unk2); + } else { + PrintAndLogEx(ERR, "Bad digits (0:%1x - 1:%1x - 2:%1x - 3:%1x - 4:%1x - 5:%1x)", r0, r1, r2, r3, r4, r5); + return ret; } - return PM3_ESOFT; } - - /* Index map E E - preamble enc tag type encrypted uid P d 33 d 90 d 04 d 71 d 40 d 45 d E7 P - 1111111110 00101101000001011010001100100100001011010100110101100 1 0 00110011 0 10010000 0 00000100 0 01110001 0 01000000 0 01000101 0 11100111 1 - uid2 uid1 uid0 I I R R - 1111111110 00101101000001011010001100100100001011010100110101100 1 - - 0 00110011 - 0 10010000 - 0 00000100 - 0 01110001 - 0 01000000 - 0 01000101 - 0 11100111 - 1 - - Tag ID is 049033 - I = Identical on all tags - R = Random ? - UID2, UID1, UID0 == card number - - */ - //get raw ID before removing parities - uint32_t raw[4] = {0, 0, 0, 0}; - raw[0] = bytebits_to_byte(DemodBuffer + idx + 96, 32); - raw[1] = bytebits_to_byte(DemodBuffer + idx + 64, 32); - raw[2] = bytebits_to_byte(DemodBuffer + idx + 32, 32); - raw[3] = bytebits_to_byte(DemodBuffer + idx, 32); - setDemodBuff(DemodBuffer, 128, idx); - setClockGrid(g_DemodClock, g_DemodStartIdx + (idx * g_DemodClock)); - - uint8_t firstParity = GetParity(DemodBuffer, EVEN, 63); - if (firstParity != DemodBuffer[63]) { - PrintAndLogEx(DEBUG, "DEBUG: Error - Nedap 1st 64bit parity check failed: %d|%d ", DemodBuffer[63], firstParity); - return PM3_ESOFT; - } - - uint8_t secondParity = GetParity(DemodBuffer + 64, EVEN, 63); - if (secondParity != DemodBuffer[127]) { - PrintAndLogEx(DEBUG, "DEBUG: Error - Nedap 2st 64bit parity check failed: %d|%d ", DemodBuffer[127], secondParity); - return PM3_ESOFT; - } - - // ok valid card found! - uint32_t uid = 0; - uid = bytebits_to_byte(DemodBuffer + 65, 8); - uid |= bytebits_to_byte(DemodBuffer + 74, 8) << 8; - uid |= bytebits_to_byte(DemodBuffer + 83, 8) << 16; - - uint16_t two = 0; - two = bytebits_to_byte(DemodBuffer + 92, 8); - two |= bytebits_to_byte(DemodBuffer + 101, 8) << 8; - - uint16_t chksum2 = 0; - chksum2 = bytebits_to_byte(DemodBuffer + 110, 8); - chksum2 |= bytebits_to_byte(DemodBuffer + 119, 8) << 8; - - PrintAndLogEx(SUCCESS, "NEDAP ID Found - Raw: %08x%08x%08x%08x", raw[3], raw[2], raw[1], raw[0]); - PrintAndLogEx(SUCCESS, " - UID: %06X", uid); - PrintAndLogEx(SUCCESS, " - i: %04X", two); - PrintAndLogEx(SUCCESS, " - Checksum2 %04X", chksum2); - - if (g_debugMode) { - PrintAndLogEx(DEBUG, "DEBUG: idx: %d, Len: %d, Printing Demod Buffer:", idx, 128); - printDemodBuff(); - PrintAndLogEx(DEBUG, "BIN:\n%s", sprint_bin_break(DemodBuffer, 128, 64)); - } - + return PM3_SUCCESS; } -/* + +/* Index map E E + preamble enc tag type encrypted uid P d 33 d 90 d 04 d 71 d 40 d 45 d E7 P + 1111111110 00101101000001011010001100100100001011010100110101100 1 0 00110011 0 10010000 0 00000100 0 01110001 0 01000000 0 01000101 0 11100111 1 + uid2 uid1 uid0 I I R R + 1111111110 00101101000001011010001100100100001011010100110101100 1 + + 0 00110011 + 0 10010000 + 0 00000100 + 0 01110001 + 0 01000000 + 0 01000101 + 0 11100111 + 1 + + Tag ID is 049033 + I = Identical on all tags + R = Random ? + UID2, UID1, UID0 == card number + + configuration lf t55xx wr b 0 d 00170082 @@ -163,51 +286,181 @@ lf t55xx wr b 4 d 4c0003ff */ static int CmdLFNedapRead(const char *Cmd) { - lf_read(true, 12000); + lf_read(true, 16000); return CmdLFNedapDemod(Cmd); } -/* -static int CmdLFNedapClone(const char *Cmd) { - char cmdp = param_getchar(Cmd, 0); - if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_nedap_clone(); +static void NedapGen(uint8_t subType, uint16_t customerCode, uint32_t id, bool isLong, uint8_t *data) { // 8 or 16 + uint8_t buffer[7], r1, r2, r3, r4, r5, idxC1, idxC2, idxC3, idxC4, idxC5, i, tmp, carry, id2, id1, id0; + uint16_t checksum; - uint32_t cardnumber=0, cn = 0; - uint32_t blocks[5]; - uint8_t bits[128]; - memset(bits, 0x00, sizeof(bits)); + r1 = (uint8_t)(id / 10000); + r2 = (uint8_t)((id % 10000) / 1000); + r3 = (uint8_t)((id % 1000) / 100); + r4 = (uint8_t)((id % 100) / 10); + r5 = (uint8_t)(id % 10); - if (sscanf(Cmd, "%u", &cn ) != 1) return usage_lf_nedap_clone(); + // first part + idxC1 = r1; + idxC2 = (idxC1 + 1 + r2) % 10; + idxC3 = (idxC2 + 1 + r3) % 10; + idxC4 = (idxC3 + 1 + r4) % 10; + idxC5 = (idxC4 + 1 + r5) % 10; - cardnumber = (cn & 0x00FFFFFF); + buffer[0] = 0xc0 | (subType & 0x0F); + buffer[1] = (customerCode & 0x0FF0) >> 4; + buffer[2] = ((customerCode & 0x000F) << 4) | translateTable[idxC1]; + buffer[3] = (translateTable[idxC2] << 4) | translateTable[idxC3]; + buffer[4] = (translateTable[idxC4] << 4) | translateTable[idxC5]; - if ( getNedapBits(cardnumber, bits) == PM3_SUCCESS ) { + // checksum + init_table(CRC_XMODEM); + checksum = crc16_xmodem(buffer, 5); + + buffer[6] = ((checksum & 0x000F) << 4) | (buffer[4] & 0x0F); + buffer[5] = (checksum & 0x00F0) | ((buffer[4] & 0xF0) >> 4); + buffer[4] = ((checksum & 0x0F00) >> 4) | (buffer[3] & 0x0F); + buffer[3] = ((checksum & 0xF000) >> 8) | ((buffer[3] & 0xF0) >> 4); + + // carry calc + for (i = 0, carry = 0; i < sizeof(buffer); i++) { + tmp = buffer[sizeof(buffer) - 1 - i]; + data[7 - i] = ((tmp & 0x7F) << 1) | carry; + carry = (tmp & 0x80) >> 7; + } + data[0] = 0xFE | carry; + data[7] |= isEven_64_63(data); + + // second part + if (isLong) { + id0 = r1; + id1 = (r2 << 4) | r3; + id2 = (r4 << 4) | r5; + + data[8] = (id2 >> 1); + data[9] = ((id2 & 0x01) << 7) | (id1 >> 2); + data[10] = ((id1 & 0x03) << 6) | (id0 >> 3); + data[11] = ((id0 & 0x07) << 5) | (FIXED_71 >> 4); + data[12] = ((FIXED_71 & 0x0F) << 4) | (FIXED_40 >> 5); + data[13] = ((FIXED_40 & 0x1F) << 3) | (UNKNOWN_A >> 6); + data[14] = ((UNKNOWN_A & 0x3F) << 2) | (UNKNOWN_B >> 7); + data[15] = ((UNKNOWN_B & 0x7F) << 1); + data[15] |= isEven_64_63(data + 8); + } +} + +static int (*usage_to_be_displayed)(void) = NULL; + +static int CmdLfNedapGen(const char *Cmd) { + uint8_t cmdp = 0, subType = 5, data[16], i, bin[128]; + uint16_t customerCode = 0; + uint32_t id = 0; + bool isLong = false, errors = false; + + int (*usage)(void) = usage_lf_nedap_gen; + if (usage_to_be_displayed != NULL) { + usage = usage_to_be_displayed; + usage_to_be_displayed = NULL; + } + + while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { + switch (tolower(param_getchar(Cmd, cmdp))) { + case 's': + subType = param_get8ex(Cmd, cmdp + 1, 5, 10); + cmdp += 2; + break; + case 'c': + customerCode = param_get32ex(Cmd, cmdp + 1, 0, 16); + cmdp += 2; + break; + case 'i': + id = param_get32ex(Cmd, cmdp + 1, 0, 10); + cmdp += 2; + break; + case 'l': + isLong = true; + cmdp++; + break; + default: + PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp)); + errors = true; + break; + } + } + //Validations + if ((!customerCode) || (!id) || (subType > 0xF) || (customerCode > 0xFFF) || (id > 99999)) + errors = true; + + if (errors || cmdp == 0) { + usage(); + return PM3_EINVARG; + } + + PrintAndLogEx(SUCCESS, + "Tag (%s) ; subtype : %1u , customer : %03x , ID : %05u" + , isLong ? "long (128b)" : "short (64b)" + , subType + , customerCode + , id + ); + + NedapGen(subType, customerCode, id, isLong, data); + + for (i = 0; i < (isLong ? 16 : 8); i++) + num_to_bytebits(data[i], 8, bin + i * 8); + + setDemodBuff(bin, (isLong ? 128 : 64), 0); + return PM3_SUCCESS; +} + +int CmdLFNedapClone(const char *Cmd) { + uint8_t max; + uint32_t blocks[5] = {0}; + + char cmdp = tolower(param_getchar(Cmd, 0)); + if (strlen(Cmd) == 0 || cmdp == 'h') return usage_lf_nedap_clone(); + + usage_to_be_displayed = usage_lf_nedap_clone; + + int ret = CmdLfNedapGen(Cmd); + if (ret != PM3_SUCCESS) + return ret; + + if ((DemodBufferLen != 128) && (DemodBufferLen != 64)) { PrintAndLogEx(ERR, "Error with tag bitstream generation."); return PM3_ESOFT; } + + CmdPrintDemodBuff("x"); - ((ASK/DIphase data rawdemod ab 0 64 1 0 +// What we had before in commented code: //NEDAP - compat mode, ASK/DIphase, data rate 64, 4 data blocks - // DI-pahse (CDP) T55x7_MODULATION_DIPHASE - blocks[0] = T55x7_MODULATION_DIPHASE | T55x7_BITRATE_RF_64 | 7 << T55x7_MAXBLOCK_SHIFT; + // DI-phase (CDP) T55x7_MODULATION_DIPHASE +// blocks[0] = T55x7_MODULATION_DIPHASE | T55x7_BITRATE_RF_64 | 7 << T55x7_MAXBLOCK_SHIFT; +// if (param_getchar(Cmd, 3) == 'Q' || param_getchar(Cmd, 3) == 'q') +// blocks[0] = T5555_MODULATION_BIPHASE | T5555_INVERT_OUTPUT | T5555_SET_BITRATE(64) | 7 <encoding = 2; payload->invert = 1; payload->separator = 0; payload->clock = 64; - memcpy(payload->data, bs, sizeof(bs)); + memcpy(payload->data, DemodBuffer, DemodBufferLen); clearCommandBuffer(); - SendCommandNG(CMD_LF_ASK_SIMULATE, (uint8_t *)payload, sizeof(lf_asksim_t) + sizeof(bs)); + SendCommandNG(CMD_LF_ASK_SIMULATE, (uint8_t *)payload, sizeof(lf_asksim_t) + DemodBufferLen); free(payload); PacketResponseNG resp; @@ -268,62 +520,17 @@ static int CmdLFNedapSim(const char *Cmd) { PrintAndLogEx(INFO, "Done"); if (resp.status != PM3_EOPABORTED) return resp.status; - return PM3_SUCCESS; -} - -static int CmdLFNedapChk(const char *Cmd) { - //301600714021BE - uint8_t data[256] = { 0x30, 0x16, 0x00, 0x71, 0x40, 0x21, 0xBE}; - int len = 0; - param_gethex_ex(Cmd, 0, data, &len); - - len = (len == 0) ? 5 : len >> 1; - - PrintAndLogEx(SUCCESS, "Input: [%d] %s", len, sprint_hex(data, len)); - - //uint8_t last = GetParity(data, EVEN, 62); - //PrintAndLogEx(NORMAL, "TEST PARITY:: %d | %d ", DemodBuffer[62], last); - - uint8_t cl = 0x1D, ch = 0x1D; - - for (int i = len; i >= 0; --i) { - uint8_t al = data[i]; - for (int j = 8; j > 0; --j) { - - uint8_t bl = al ^ ch; - //PrintAndLogEx(NORMAL, "BL %02x | CH %02x \n", al, ch); - - uint8_t carry = (cl & 0x80) ? 1 : 0; - cl <<= 1; - - uint8_t temp = (ch & 0x80) ? 1 : 0; - ch = (ch << 1) | carry; - carry = temp; - - carry = (al & 0x80) ? 1 : 0; - al <<= 1; - - carry = (bl & 0x80) ? 1 : 0; -// bl <<= 1; - - if (carry) { - cl ^= 0x21; - ch ^= 0x10; - } - } - } - - PrintAndLogEx(SUCCESS, "Nedap checksum: 0x%X", ((ch << 8) | cl)); + return PM3_SUCCESS; } static command_t CommandTable[] = { - {"help", CmdHelp, AlwaysAvailable, "this help"}, - {"demod", CmdLFNedapDemod, AlwaysAvailable, "demodulate an Nedap tag from the GraphBuffer"}, - {"read", CmdLFNedapRead, IfPm3Lf, "attempt to read and extract tag data"}, -// {"clone", CmdLFNedapClone, IfPm3Lf, " clone nedap tag"}, - {"sim", CmdLFNedapSim, IfPm3Lf, "simulate nedap tag"}, - {"chk", CmdLFNedapChk, AlwaysAvailable, "calculate Nedap Checksum "}, + {"help", CmdHelp, AlwaysAvailable, "This help"}, + {"demod", CmdLFNedapDemod, AlwaysAvailable, "Demodulate Nedap tag from the GraphBuffer"}, + {"generate", CmdLfNedapGen, AlwaysAvailable, "Generate Nedap bitstream in DemodBuffer"}, + {"read", CmdLFNedapRead, IfPm3Lf, "Attempt to read and extract tag data from the antenna"}, + {"clone", CmdLFNedapClone, IfPm3Lf, "Clone Nedap tag to T55x7"}, + {"sim", CmdLFNedapSim, IfPm3Lf, "Simulate Nedap tag"}, {NULL, NULL, NULL, NULL} }; @@ -338,72 +545,6 @@ int CmdLFNedap(const char *Cmd) { return CmdsParse(CommandTable, Cmd); } -// find nedap preamble in already demoded data -int detectNedap(uint8_t *dest, size_t *size) { - //make sure buffer has data - if (*size < 128) return -3; - - size_t startIdx = 0; - //uint8_t preamble[] = {1,1,1,1,1,1,1,1,1,0,0,0,1}; - uint8_t preamble[] = {1, 1, 1, 1, 1, 1, 1, 1, 1, 0}; - if (!preambleSearch(dest, preamble, sizeof(preamble), size, &startIdx)) - return -4; //preamble not found - return (int) startIdx; -} - -int getNedapBits(uint32_t cn, uint8_t *nedapBits) { - - uint8_t pre[128]; - memset(pre, 0x00, sizeof(pre)); - - // preamble 1111 1111 10 = 0xFF8 - num_to_bytebits(0xFF8, 12, pre); - - // fixed tagtype code? 0010 1101 = 0x2D - num_to_bytebits(0x2D, 8, pre + 10); - - // 46 encrypted bits - UNKNOWN ALGO - // -- 16 bits checksum. Should be 4x4 checksum, based on UID and 2 constant values. - // -- 30 bits undocumented? - //num_to_bytebits(cn, 46, pre+18); - - //----from this part, the UID in clear text, with a 1bit ZERO as separator between bytes. - pre[64] = 0; - pre[73] = 0; - pre[82] = 0; - pre[91] = 0; - pre[100] = 0; - pre[109] = 0; - pre[118] = 0; - - // cardnumber (uid) - num_to_bytebits((cn >> 0) & 0xFF, 8, pre + 65); - num_to_bytebits((cn >> 8) & 0xFF, 8, pre + 74); - num_to_bytebits((cn >> 16) & 0xFF, 8, pre + 83); - - // two ? - num_to_bytebits(0, 8, pre + 92); - num_to_bytebits(0, 8, pre + 101); - - // chksum - num_to_bytebits((0 >> 0) & 0xFF, 8, pre + 110); - num_to_bytebits((0 >> 8) & 0xFF, 8, pre + 119); - - pre[63] = GetParity(pre, EVEN, 63); - pre[127] = GetParity(pre + 64, EVEN, 63); - - memcpy(nedapBits, pre, 128); - - // 1111111110001011010000010110100011001001000010110101001101011001000110011010010000000000100001110001001000000001000101011100111 - return PM3_SUCCESS; -} -/* - - UID: 001630 - - i: 4071 - - Checksum2 BE21 -*/ -//GetParity( uint8_t *bits, uint8_t type, int length) - int demodNedap(void) { return CmdLFNedapDemod(""); } diff --git a/client/cmdlfnoralsy.c b/client/cmdlfnoralsy.c index a6c58a3ed..ec8da0bf9 100644 --- a/client/cmdlfnoralsy.c +++ b/client/cmdlfnoralsy.c @@ -131,8 +131,8 @@ static int CmdNoralsyClone(const char *Cmd) { uint8_t bits[96]; memset(bits, 0, sizeof(bits)); - char cmdp = param_getchar(Cmd, 0); - if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_noralsy_clone(); + char cmdp = tolower(param_getchar(Cmd, 0)); + if (strlen(Cmd) == 0 || cmdp == 'h') return usage_lf_noralsy_clone(); id = param_get32ex(Cmd, 0, 0, 10); year = param_get32ex(Cmd, 1, 2000, 10); @@ -187,8 +187,8 @@ static int CmdNoralsySim(const char *Cmd) { uint16_t year = 0; uint32_t id = 0; - char cmdp = param_getchar(Cmd, 0); - if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') + char cmdp = tolower(param_getchar(Cmd, 0)); + if (strlen(Cmd) == 0 || cmdp == 'h') return usage_lf_noralsy_sim(); id = param_get32ex(Cmd, 0, 0, 10); @@ -218,6 +218,7 @@ static int CmdNoralsySim(const char *Cmd) { PrintAndLogEx(INFO, "Done"); if (resp.status != PM3_EOPABORTED) return resp.status; + return PM3_SUCCESS; }