mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2025-08-14 10:37:23 -07:00
chg: 'lf nedap' - decoding / encoding of Nedap. (anon)
This commit is contained in:
iceman1001
parent
6f47e12797
commit
f317e3247a
2 changed files with 417 additions and 275 deletions
|
|
@ -8,137 +8,260 @@
|
|||
//-----------------------------------------------------------------------------
|
||||
|
||||
#include "cmdlfnedap.h"
|
||||
|
||||
#define FIXED_71 0x71
|
||||
#define FIXED_40 0x40
|
||||
#define UNKNOWN_A 0x00
|
||||
#define UNKNOWN_B 0x00
|
||||
|
||||
static int CmdHelp(const char *Cmd);
|
||||
|
||||
/*
|
||||
static int usage_lf_nedap_clone(void) {
|
||||
PrintAndLogEx(NORMAL, "clone a NEDAP tag to a T55x7 tag.");
|
||||
static int usage_lf_nedap_gen(void) {
|
||||
PrintAndLogEx(NORMAL, "generate Nedap bitstream in DemodBuffer");
|
||||
PrintAndLogEx(NORMAL, "");
|
||||
PrintAndLogEx(NORMAL, "Usage: lf nedap clone [h] <Card-Number>");
|
||||
PrintAndLogEx(NORMAL, "Options:");
|
||||
PrintAndLogEx(NORMAL, " h : This help");
|
||||
PrintAndLogEx(NORMAL, " <Card Number> : 24-bit value card number");
|
||||
// PrintAndLogEx(NORMAL, " Q5 : optional - clone to Q5 (T5555) instead of T55x7 chip");
|
||||
PrintAndLogEx(NORMAL, "");
|
||||
PrintAndLogEx(NORMAL, "Examples:");
|
||||
PrintAndLogEx(NORMAL, " lf nedap clone 112233");
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
*/
|
||||
|
||||
static int usage_lf_nedap_sim(void) {
|
||||
PrintAndLogEx(NORMAL, "Enables simulation of NEDAP card with specified card number.");
|
||||
PrintAndLogEx(NORMAL, "Simulation runs until the button is pressed or another USB command is issued.");
|
||||
PrintAndLogEx(NORMAL, "");
|
||||
PrintAndLogEx(NORMAL, "Usage: lf nedap sim [h] <Card-Number>");
|
||||
PrintAndLogEx(NORMAL, "Usage: lf nedap generate [h] [s <subtype>] c <code> i <id> [l]");
|
||||
PrintAndLogEx(NORMAL, "Options:");
|
||||
PrintAndLogEx(NORMAL, " h : This help");
|
||||
PrintAndLogEx(NORMAL, " <Card Number> : 24-bit value card number");
|
||||
PrintAndLogEx(NORMAL, " s <subtype> : optional, default=5");
|
||||
PrintAndLogEx(NORMAL, " c <code> : customerCode");
|
||||
PrintAndLogEx(NORMAL, " i <id> : ID (max 99999)");
|
||||
PrintAndLogEx(NORMAL, " l : optional - long (128), default to short (64)");
|
||||
PrintAndLogEx(NORMAL, "");
|
||||
PrintAndLogEx(NORMAL, "Examples:");
|
||||
PrintAndLogEx(NORMAL, " lf nedap sim 112233");
|
||||
PrintAndLogEx(NORMAL, " lf nedap generate s 1 c 123 i 112233");
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
static int usage_lf_nedap_clone(void) {
|
||||
PrintAndLogEx(NORMAL, "clone a Nedap tag to a T55x7 tag.");
|
||||
PrintAndLogEx(NORMAL, "");
|
||||
PrintAndLogEx(NORMAL, "Usage: lf nedap clone [h] [s <subtype>] c <code> i <id> [l]");
|
||||
PrintAndLogEx(NORMAL, "Options:");
|
||||
PrintAndLogEx(NORMAL, " h : This help");
|
||||
PrintAndLogEx(NORMAL, " s <subtype> : optional, default=5");
|
||||
PrintAndLogEx(NORMAL, " c <code> : customerCode");
|
||||
PrintAndLogEx(NORMAL, " i <id> : ID (max 99999)");
|
||||
PrintAndLogEx(NORMAL, " l : optional - long (128), default to short (64)");
|
||||
// PrintAndLogEx(NORMAL, " Q5 : optional - clone to Q5 (T5555) instead of T55x7 chip");
|
||||
PrintAndLogEx(NORMAL, "");
|
||||
PrintAndLogEx(NORMAL, "Examples:");
|
||||
PrintAndLogEx(NORMAL, " lf nedap clone s 1 c 123 i 112233");
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
static int usage_lf_nedap_sim(void) {
|
||||
PrintAndLogEx(NORMAL, "simulate Nedap card.");
|
||||
PrintAndLogEx(NORMAL, "Simulation runs until the button is pressed or another USB command is issued.");
|
||||
PrintAndLogEx(NORMAL, "");
|
||||
PrintAndLogEx(NORMAL, "Usage: lf nedap sim [h] [s <subtype>] c <code> i <id> [l]");
|
||||
PrintAndLogEx(NORMAL, "Options:");
|
||||
PrintAndLogEx(NORMAL, " h : This help");
|
||||
PrintAndLogEx(NORMAL, " s <subtype> : subtype, default=5");
|
||||
PrintAndLogEx(NORMAL, " c <code> : customerCode");
|
||||
PrintAndLogEx(NORMAL, " i <id> : ID (max 99999)");
|
||||
PrintAndLogEx(NORMAL, " l : long (128), default to short (64)");
|
||||
PrintAndLogEx(NORMAL, "");
|
||||
PrintAndLogEx(NORMAL, "Examples:");
|
||||
// TODO proper example?
|
||||
PrintAndLogEx(NORMAL, " lf nedap sim s 1 c 7 i 1337");
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
const uint8_t translateTable[10] = {8, 2, 1, 12, 4, 5, 10, 13, 0, 9};
|
||||
const uint8_t invTranslateTable[16] = {8, 2, 1, 0xff, 4, 5, 0xff, 0xff, 0, 9, 6, 0xff, 3, 7, 0xff, 0xff};
|
||||
const uint8_t preamble[] = {1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0}; // zero inside
|
||||
|
||||
static inline uint32_t bitcount(uint32_t a) {
|
||||
#if defined __GNUC__
|
||||
return __builtin_popcountl(a);
|
||||
#else
|
||||
a = a - ((a >> 1) & 0x55555555);
|
||||
a = (a & 0x33333333) + ((a >> 2) & 0x33333333);
|
||||
return (((a + (a >> 4)) & 0x0f0f0f0f) * 0x01010101) >> 24;
|
||||
#endif
|
||||
}
|
||||
|
||||
static uint8_t isEven_64_63(const uint8_t *data) { // 8
|
||||
return (bitcount(*(uint32_t *) data) + (bitcount((*(uint32_t *)(data + 4)) & 0xfeffffff))) & 1;
|
||||
}
|
||||
|
||||
//NEDAP demod - ASK/Biphase (or Diphase), RF/64 with preamble of 1111111110 (always a 128 bit data stream)
|
||||
//print NEDAP Prox ID, encoding, encrypted ID,
|
||||
static int CmdLFNedapDemod(const char *Cmd) {
|
||||
(void)Cmd; // Cmd is not used so far
|
||||
//raw ask demod no start bit finding just get binary from wave
|
||||
|
||||
uint8_t data[16], buffer[7], r0, r1, r2, r3, r4, r5, idxC1, idxC2, idxC3, idxC4, idxC5, fixed0, fixed1, unk1, unk2, subtype; // 4 bits
|
||||
size_t size, offset = 0;
|
||||
uint16_t checksum, customerCode; // 12 bits
|
||||
uint32_t badgeId; // max 99999
|
||||
|
||||
if (ASKbiphaseDemod("0 64 1 0", false) != PM3_SUCCESS) {
|
||||
if (g_debugMode) PrintAndLogEx(DEBUG, "DEBUG: Error - Nedap ASKbiphaseDemod failed");
|
||||
if (g_debugMode) PrintAndLogEx(DEBUG, "DEBUG: Error - NEDAP: ASK/Biphase Demod failed");
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
size_t size = DemodBufferLen;
|
||||
int idx = detectNedap(DemodBuffer, &size);
|
||||
if (idx < 0) {
|
||||
if (g_debugMode) {
|
||||
// if (idx == -5)
|
||||
// PrintAndLogEx(DEBUG, "DEBUG: Error - not enough samples");
|
||||
// else if (idx == -1)
|
||||
// PrintAndLogEx(DEBUG, "DEBUG: Error - only noise found");
|
||||
// else if (idx == -2)
|
||||
// PrintAndLogEx(DEBUG, "DEBUG: Error - problem during ASK/Biphase demod");
|
||||
if (idx == -3)
|
||||
PrintAndLogEx(DEBUG, "DEBUG: Error - Nedap Size not correct: %d", size);
|
||||
else if (idx == -4)
|
||||
PrintAndLogEx(DEBUG, "DEBUG: Error - Nedap preamble not found");
|
||||
else
|
||||
PrintAndLogEx(DEBUG, "DEBUG: Error - Nedap idx: %d", idx);
|
||||
|
||||
size = DemodBufferLen;
|
||||
if (!preambleSearch(DemodBuffer, (uint8_t *) preamble, sizeof(preamble), &size, &offset)) {
|
||||
PrintAndLogEx(DEBUG, "DEBUG: Error - NEDAP: preamble not found");
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
// set plot
|
||||
setDemodBuff(DemodBuffer, size, offset);
|
||||
setClockGrid(g_DemodClock, g_DemodStartIdx + (g_DemodClock * offset));
|
||||
|
||||
// sanity checks
|
||||
if ((size != 128) && (size != 64)) {
|
||||
PrintAndLogEx(DEBUG, "DEBUG: Error - NEDAP: Size not correct: %d", size);
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
if (bits_to_array(DemodBuffer, size, data) != PM3_SUCCESS) {
|
||||
PrintAndLogEx(DEBUG, "DEBUG: Error - NEDAP: bits_to_array error\n");
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
|
||||
int ret = PM3_SUCCESS;
|
||||
|
||||
// first part
|
||||
|
||||
// parity 1 check
|
||||
if (isEven_64_63(data) != (data[7] & 0x01)) {
|
||||
PrintAndLogEx(ERR, "Bad parity (%1u)", data[7] & 0x01);
|
||||
ret = PM3_ESOFT;
|
||||
}
|
||||
|
||||
// header 1 check
|
||||
// (1111111110 0 -- zero inside)
|
||||
if ((data[0] != 0xFF) && ((data[1] & 0xE0) != 0x80)) {
|
||||
PrintAndLogEx(ERR, "Bad header");
|
||||
ret = PM3_ESOFT;
|
||||
}
|
||||
|
||||
buffer[0] = (data[0] << 7) | (data[1] >> 1);
|
||||
buffer[1] = (data[1] << 7) | (data[2] >> 1);
|
||||
buffer[2] = (data[2] << 7) | (data[3] >> 1);
|
||||
buffer[3] = ((data[4] & 0x1e) << 3) | ((data[5] & 0x1e) >> 1);
|
||||
buffer[4] = ((data[6] & 0x1e) << 3) | ((data[7] & 0x1e) >> 1);
|
||||
|
||||
// CHECKSUM
|
||||
init_table(CRC_XMODEM);
|
||||
checksum = crc16_xmodem(buffer, 5);
|
||||
|
||||
buffer[6] = (data[3] << 7) | ((data[4] & 0xe0) >> 1) | ((data[4] & 0x01) << 3) | ((data[5] & 0xe0) >> 5);
|
||||
buffer[5] = (data[5] << 7) | ((data[6] & 0xe0) >> 1) | ((data[6] & 0x01) << 3) | ((data[7] & 0xe0) >> 5);
|
||||
|
||||
bool isValid = (checksum == *(uint16_t *)(buffer + 5));
|
||||
|
||||
subtype = (data[1] & 0x1e) >> 1;
|
||||
customerCode = ((data[1] & 0x01) << 11) | (data[2] << 3) | ((data[3] & 0xe0) >> 5);
|
||||
|
||||
if ( isValid == false ) {
|
||||
PrintAndLogEx(ERR, "Checksum : %s (calc 0x%04X != 0x%04X)", _RED_("failed"), checksum, *(uint16_t *)(buffer + 5));
|
||||
ret = PM3_ESOFT;
|
||||
}
|
||||
|
||||
idxC1 = invTranslateTable[(data[3] & 0x1e) >> 1];
|
||||
idxC2 = invTranslateTable[(data[4] & 0x1e) >> 1];
|
||||
idxC3 = invTranslateTable[(data[5] & 0x1e) >> 1];
|
||||
idxC4 = invTranslateTable[(data[6] & 0x1e) >> 1];
|
||||
idxC5 = invTranslateTable[(data[7] & 0x1e) >> 1];
|
||||
|
||||
// validation
|
||||
if ((idxC1 != 0xFF) && (idxC2 != 0xFF) && (idxC3 != 0xFF) && (idxC4 != 0xFF) && (idxC5 != 0xFF)) {
|
||||
r1 = idxC1;
|
||||
r2 = ((10 + idxC2) - (idxC1 + 1)) % 10;
|
||||
r3 = ((10 + idxC3) - (idxC2 + 1)) % 10;
|
||||
r4 = ((10 + idxC4) - (idxC3 + 1)) % 10;
|
||||
r5 = ((10 + idxC5) - (idxC4 + 1)) % 10;
|
||||
|
||||
badgeId = r1 * 10000 + r2 * 1000 + r3 * 100 + r4 * 10 + r5;
|
||||
|
||||
PrintAndLogEx(SUCCESS, "NEDAP Tag Found: Card ID "_YELLOW_("%05u")" subtype: "_YELLOW_("%1u")" customer code: "_YELLOW_("%03x"), badgeId, subtype, customerCode);
|
||||
PrintAndLogEx(SUCCESS, "Checksum is %s (0x%04X)", _GREEN_("OK"), checksum );
|
||||
PrintAndLogEx(SUCCESS, "Raw: %s", sprint_hex(data, size/8));
|
||||
} else {
|
||||
PrintAndLogEx(ERR, "Invalid idx (1:%02x - 2:%02x - 3:%02x - 4:%02x - 5:%02x)", idxC1, idxC2, idxC3, idxC4, idxC5);
|
||||
ret = PM3_ESOFT;
|
||||
}
|
||||
|
||||
if (size > 64) {
|
||||
// second part
|
||||
PrintAndLogEx(DEBUG, "NEDAP Tag, second part found");
|
||||
|
||||
if (isEven_64_63(data + 8) != (data[15] & 0x01)) {
|
||||
PrintAndLogEx(ERR, "Bad parity (%1u)", data[15] & 0x01);
|
||||
return ret;
|
||||
}
|
||||
|
||||
// validation
|
||||
if ( (data[8] & 0x80)
|
||||
&& (data[9] & 0x40)
|
||||
&& (data[10] & 0x20)
|
||||
&& (data[11] & 0x10)
|
||||
&& (data[12] & 0x08)
|
||||
&& (data[13] & 0x04)
|
||||
&& (data[14] & 0x02)) {
|
||||
PrintAndLogEx(ERR, "Bad zeros");
|
||||
return ret;
|
||||
}
|
||||
|
||||
//
|
||||
r4 = (data[8] >> 3) & 0x0F;
|
||||
r5 = ((data[8] << 1) & 0x0F) | (data[9] >> 7);
|
||||
r2 = (data[9] >> 2) & 0x0F;
|
||||
r3 = ((data[9] << 2) & 0x0F) | (data[10] >> 6);
|
||||
r0 = ((data[10] >> 1) & 0x0F);
|
||||
r1 = ((data[10] << 3) & 0x0F) | (data[11] >> 5);
|
||||
|
||||
fixed0 = ((data[11] << 4) & 0xF0) | (data[12] >> 4);
|
||||
fixed1 = ((data[12] << 5) & 0xE0) | (data[13] >> 3);
|
||||
|
||||
unk1 = ((data[13] << 6) & 0xC0) | (data[14] >> 2);
|
||||
unk2 = ((data[14] << 7) & 0xC0) | (data[15] >> 1);
|
||||
|
||||
// validation 2
|
||||
if (!r0 && (r1 < 10) && (r2 < 10) && (r3 < 10) && (r4 < 10) && (r5 < 10)) {
|
||||
|
||||
badgeId = r1 * 10000 + r2 * 1000 + r3 * 100 + r4 * 10 + r5;
|
||||
PrintAndLogEx(SUCCESS, "Second Card Id " _YELLOW_("%05u"), badgeId);
|
||||
|
||||
if ((fixed0 == FIXED_71) && (fixed1 == FIXED_40))
|
||||
PrintAndLogEx(DEBUG, "Fixed part {0 = 0x%02x, 1 = 0x%02x}", fixed0, fixed1);
|
||||
else
|
||||
PrintAndLogEx(DEBUG, "Bad fixed: {0 = 0x%02x (%0x02x), 1 = 0x%02x (%0x02x)}", fixed0, FIXED_71, fixed1, FIXED_40);
|
||||
|
||||
PrintAndLogEx(DEBUG, "Unknown part {1 = 0x%02x, 2 = 0x%02x}", unk1, unk2);
|
||||
} else {
|
||||
PrintAndLogEx(ERR, "Bad digits (0:%1x - 1:%1x - 2:%1x - 3:%1x - 4:%1x - 5:%1x)", r0, r1, r2, r3, r4, r5);
|
||||
return ret;
|
||||
}
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
/* Index map E E
|
||||
preamble enc tag type encrypted uid P d 33 d 90 d 04 d 71 d 40 d 45 d E7 P
|
||||
1111111110 00101101000001011010001100100100001011010100110101100 1 0 00110011 0 10010000 0 00000100 0 01110001 0 01000000 0 01000101 0 11100111 1
|
||||
uid2 uid1 uid0 I I R R
|
||||
1111111110 00101101000001011010001100100100001011010100110101100 1
|
||||
|
||||
0 00110011
|
||||
0 10010000
|
||||
0 00000100
|
||||
0 01110001
|
||||
0 01000000
|
||||
0 01000101
|
||||
0 11100111
|
||||
1
|
||||
|
||||
Tag ID is 049033
|
||||
I = Identical on all tags
|
||||
R = Random ?
|
||||
UID2, UID1, UID0 == card number
|
||||
|
||||
*/
|
||||
//get raw ID before removing parities
|
||||
uint32_t raw[4] = {0, 0, 0, 0};
|
||||
raw[0] = bytebits_to_byte(DemodBuffer + idx + 96, 32);
|
||||
raw[1] = bytebits_to_byte(DemodBuffer + idx + 64, 32);
|
||||
raw[2] = bytebits_to_byte(DemodBuffer + idx + 32, 32);
|
||||
raw[3] = bytebits_to_byte(DemodBuffer + idx, 32);
|
||||
setDemodBuff(DemodBuffer, 128, idx);
|
||||
setClockGrid(g_DemodClock, g_DemodStartIdx + (idx * g_DemodClock));
|
||||
|
||||
uint8_t firstParity = GetParity(DemodBuffer, EVEN, 63);
|
||||
if (firstParity != DemodBuffer[63]) {
|
||||
PrintAndLogEx(DEBUG, "DEBUG: Error - Nedap 1st 64bit parity check failed: %d|%d ", DemodBuffer[63], firstParity);
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
uint8_t secondParity = GetParity(DemodBuffer + 64, EVEN, 63);
|
||||
if (secondParity != DemodBuffer[127]) {
|
||||
PrintAndLogEx(DEBUG, "DEBUG: Error - Nedap 2st 64bit parity check failed: %d|%d ", DemodBuffer[127], secondParity);
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
// ok valid card found!
|
||||
uint32_t uid = 0;
|
||||
uid = bytebits_to_byte(DemodBuffer + 65, 8);
|
||||
uid |= bytebits_to_byte(DemodBuffer + 74, 8) << 8;
|
||||
uid |= bytebits_to_byte(DemodBuffer + 83, 8) << 16;
|
||||
|
||||
uint16_t two = 0;
|
||||
two = bytebits_to_byte(DemodBuffer + 92, 8);
|
||||
two |= bytebits_to_byte(DemodBuffer + 101, 8) << 8;
|
||||
|
||||
uint16_t chksum2 = 0;
|
||||
chksum2 = bytebits_to_byte(DemodBuffer + 110, 8);
|
||||
chksum2 |= bytebits_to_byte(DemodBuffer + 119, 8) << 8;
|
||||
|
||||
PrintAndLogEx(SUCCESS, "NEDAP ID Found - Raw: %08x%08x%08x%08x", raw[3], raw[2], raw[1], raw[0]);
|
||||
PrintAndLogEx(SUCCESS, " - UID: %06X", uid);
|
||||
PrintAndLogEx(SUCCESS, " - i: %04X", two);
|
||||
PrintAndLogEx(SUCCESS, " - Checksum2 %04X", chksum2);
|
||||
|
||||
if (g_debugMode) {
|
||||
PrintAndLogEx(DEBUG, "DEBUG: idx: %d, Len: %d, Printing Demod Buffer:", idx, 128);
|
||||
printDemodBuff();
|
||||
PrintAndLogEx(DEBUG, "BIN:\n%s", sprint_bin_break(DemodBuffer, 128, 64));
|
||||
}
|
||||
|
||||
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
/*
|
||||
|
||||
/* Index map E E
|
||||
preamble enc tag type encrypted uid P d 33 d 90 d 04 d 71 d 40 d 45 d E7 P
|
||||
1111111110 00101101000001011010001100100100001011010100110101100 1 0 00110011 0 10010000 0 00000100 0 01110001 0 01000000 0 01000101 0 11100111 1
|
||||
uid2 uid1 uid0 I I R R
|
||||
1111111110 00101101000001011010001100100100001011010100110101100 1
|
||||
|
||||
0 00110011
|
||||
0 10010000
|
||||
0 00000100
|
||||
0 01110001
|
||||
0 01000000
|
||||
0 01000101
|
||||
0 11100111
|
||||
1
|
||||
|
||||
Tag ID is 049033
|
||||
I = Identical on all tags
|
||||
R = Random ?
|
||||
UID2, UID1, UID0 == card number
|
||||
|
||||
|
||||
configuration
|
||||
lf t55xx wr b 0 d 00170082
|
||||
|
||||
|
|
@ -163,51 +286,181 @@ lf t55xx wr b 4 d 4c0003ff
|
|||
*/
|
||||
|
||||
static int CmdLFNedapRead(const char *Cmd) {
|
||||
lf_read(true, 12000);
|
||||
lf_read(true, 16000);
|
||||
return CmdLFNedapDemod(Cmd);
|
||||
}
|
||||
/*
|
||||
static int CmdLFNedapClone(const char *Cmd) {
|
||||
|
||||
char cmdp = param_getchar(Cmd, 0);
|
||||
if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_nedap_clone();
|
||||
static void NedapGen(uint8_t subType, uint16_t customerCode, uint32_t id, bool isLong, uint8_t *data) { // 8 or 16
|
||||
uint8_t buffer[7], r1, r2, r3, r4, r5, idxC1, idxC2, idxC3, idxC4, idxC5, i, tmp, carry, id2, id1, id0;
|
||||
uint16_t checksum;
|
||||
|
||||
uint32_t cardnumber=0, cn = 0;
|
||||
uint32_t blocks[5];
|
||||
uint8_t bits[128];
|
||||
memset(bits, 0x00, sizeof(bits));
|
||||
r1 = (uint8_t)(id / 10000);
|
||||
r2 = (uint8_t)((id % 10000) / 1000);
|
||||
r3 = (uint8_t)((id % 1000) / 100);
|
||||
r4 = (uint8_t)((id % 100) / 10);
|
||||
r5 = (uint8_t)(id % 10);
|
||||
|
||||
if (sscanf(Cmd, "%u", &cn ) != 1) return usage_lf_nedap_clone();
|
||||
// first part
|
||||
idxC1 = r1;
|
||||
idxC2 = (idxC1 + 1 + r2) % 10;
|
||||
idxC3 = (idxC2 + 1 + r3) % 10;
|
||||
idxC4 = (idxC3 + 1 + r4) % 10;
|
||||
idxC5 = (idxC4 + 1 + r5) % 10;
|
||||
|
||||
cardnumber = (cn & 0x00FFFFFF);
|
||||
buffer[0] = 0xc0 | (subType & 0x0F);
|
||||
buffer[1] = (customerCode & 0x0FF0) >> 4;
|
||||
buffer[2] = ((customerCode & 0x000F) << 4) | translateTable[idxC1];
|
||||
buffer[3] = (translateTable[idxC2] << 4) | translateTable[idxC3];
|
||||
buffer[4] = (translateTable[idxC4] << 4) | translateTable[idxC5];
|
||||
|
||||
if ( getNedapBits(cardnumber, bits) == PM3_SUCCESS ) {
|
||||
// checksum
|
||||
init_table(CRC_XMODEM);
|
||||
checksum = crc16_xmodem(buffer, 5);
|
||||
|
||||
buffer[6] = ((checksum & 0x000F) << 4) | (buffer[4] & 0x0F);
|
||||
buffer[5] = (checksum & 0x00F0) | ((buffer[4] & 0xF0) >> 4);
|
||||
buffer[4] = ((checksum & 0x0F00) >> 4) | (buffer[3] & 0x0F);
|
||||
buffer[3] = ((checksum & 0xF000) >> 8) | ((buffer[3] & 0xF0) >> 4);
|
||||
|
||||
// carry calc
|
||||
for (i = 0, carry = 0; i < sizeof(buffer); i++) {
|
||||
tmp = buffer[sizeof(buffer) - 1 - i];
|
||||
data[7 - i] = ((tmp & 0x7F) << 1) | carry;
|
||||
carry = (tmp & 0x80) >> 7;
|
||||
}
|
||||
data[0] = 0xFE | carry;
|
||||
data[7] |= isEven_64_63(data);
|
||||
|
||||
// second part
|
||||
if (isLong) {
|
||||
id0 = r1;
|
||||
id1 = (r2 << 4) | r3;
|
||||
id2 = (r4 << 4) | r5;
|
||||
|
||||
data[8] = (id2 >> 1);
|
||||
data[9] = ((id2 & 0x01) << 7) | (id1 >> 2);
|
||||
data[10] = ((id1 & 0x03) << 6) | (id0 >> 3);
|
||||
data[11] = ((id0 & 0x07) << 5) | (FIXED_71 >> 4);
|
||||
data[12] = ((FIXED_71 & 0x0F) << 4) | (FIXED_40 >> 5);
|
||||
data[13] = ((FIXED_40 & 0x1F) << 3) | (UNKNOWN_A >> 6);
|
||||
data[14] = ((UNKNOWN_A & 0x3F) << 2) | (UNKNOWN_B >> 7);
|
||||
data[15] = ((UNKNOWN_B & 0x7F) << 1);
|
||||
data[15] |= isEven_64_63(data + 8);
|
||||
}
|
||||
}
|
||||
|
||||
static int (*usage_to_be_displayed)(void) = NULL;
|
||||
|
||||
static int CmdLfNedapGen(const char *Cmd) {
|
||||
uint8_t cmdp = 0, subType = 5, data[16], i, bin[128];
|
||||
uint16_t customerCode = 0;
|
||||
uint32_t id = 0;
|
||||
bool isLong = false, errors = false;
|
||||
|
||||
int (*usage)(void) = usage_lf_nedap_gen;
|
||||
if (usage_to_be_displayed != NULL) {
|
||||
usage = usage_to_be_displayed;
|
||||
usage_to_be_displayed = NULL;
|
||||
}
|
||||
|
||||
while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
|
||||
switch (tolower(param_getchar(Cmd, cmdp))) {
|
||||
case 's':
|
||||
subType = param_get8ex(Cmd, cmdp + 1, 5, 10);
|
||||
cmdp += 2;
|
||||
break;
|
||||
case 'c':
|
||||
customerCode = param_get32ex(Cmd, cmdp + 1, 0, 16);
|
||||
cmdp += 2;
|
||||
break;
|
||||
case 'i':
|
||||
id = param_get32ex(Cmd, cmdp + 1, 0, 10);
|
||||
cmdp += 2;
|
||||
break;
|
||||
case 'l':
|
||||
isLong = true;
|
||||
cmdp++;
|
||||
break;
|
||||
default:
|
||||
PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
|
||||
errors = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
//Validations
|
||||
if ((!customerCode) || (!id) || (subType > 0xF) || (customerCode > 0xFFF) || (id > 99999))
|
||||
errors = true;
|
||||
|
||||
if (errors || cmdp == 0) {
|
||||
usage();
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
PrintAndLogEx(SUCCESS,
|
||||
"Tag (%s) ; subtype : %1u , customer : %03x , ID : %05u"
|
||||
, isLong ? "long (128b)" : "short (64b)"
|
||||
, subType
|
||||
, customerCode
|
||||
, id
|
||||
);
|
||||
|
||||
NedapGen(subType, customerCode, id, isLong, data);
|
||||
|
||||
for (i = 0; i < (isLong ? 16 : 8); i++)
|
||||
num_to_bytebits(data[i], 8, bin + i * 8);
|
||||
|
||||
setDemodBuff(bin, (isLong ? 128 : 64), 0);
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
int CmdLFNedapClone(const char *Cmd) {
|
||||
uint8_t max;
|
||||
uint32_t blocks[5] = {0};
|
||||
|
||||
char cmdp = tolower(param_getchar(Cmd, 0));
|
||||
if (strlen(Cmd) == 0 || cmdp == 'h') return usage_lf_nedap_clone();
|
||||
|
||||
usage_to_be_displayed = usage_lf_nedap_clone;
|
||||
|
||||
int ret = CmdLfNedapGen(Cmd);
|
||||
if (ret != PM3_SUCCESS)
|
||||
return ret;
|
||||
|
||||
if ((DemodBufferLen != 128) && (DemodBufferLen != 64)) {
|
||||
PrintAndLogEx(ERR, "Error with tag bitstream generation.");
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
CmdPrintDemodBuff("x");
|
||||
|
||||
((ASK/DIphase data rawdemod ab 0 64 1 0
|
||||
// What we had before in commented code:
|
||||
//NEDAP - compat mode, ASK/DIphase, data rate 64, 4 data blocks
|
||||
// DI-pahse (CDP) T55x7_MODULATION_DIPHASE
|
||||
blocks[0] = T55x7_MODULATION_DIPHASE | T55x7_BITRATE_RF_64 | 7 << T55x7_MAXBLOCK_SHIFT;
|
||||
// DI-phase (CDP) T55x7_MODULATION_DIPHASE
|
||||
// blocks[0] = T55x7_MODULATION_DIPHASE | T55x7_BITRATE_RF_64 | 7 << T55x7_MAXBLOCK_SHIFT;
|
||||
// if (param_getchar(Cmd, 3) == 'Q' || param_getchar(Cmd, 3) == 'q')
|
||||
// blocks[0] = T5555_MODULATION_BIPHASE | T5555_INVERT_OUTPUT | T5555_SET_BITRATE(64) | 7 <<T5555_MAXBLOCK_SHIFT;
|
||||
|
||||
if (param_getchar(Cmd, 3) == 'Q' || param_getchar(Cmd, 3) == 'q')
|
||||
blocks[0] = T5555_MODULATION_BIPHASE | T5555_INVERT_OUTPUT | T5555_SET_BITRATE(64) | 7 <<T5555_MAXBLOCK_SHIFT;
|
||||
if (DemodBufferLen == 64) {
|
||||
max = 3;
|
||||
blocks[0] = T55X7_NEDAP_64_CONFIG_BLOCK;
|
||||
} else {
|
||||
max = 5;
|
||||
blocks[0] = T55X7_NEDAP_128_CONFIG_BLOCK;
|
||||
}
|
||||
|
||||
blocks[1] = bytebits_to_byte(bits, 32);
|
||||
blocks[2] = bytebits_to_byte(bits + 32, 32);
|
||||
blocks[3] = bytebits_to_byte(bits + 64, 32);
|
||||
blocks[4] = bytebits_to_byte(bits + 96, 32);
|
||||
for (uint8_t i = 1; i < max ; i++) {
|
||||
blocks[i] = bytebits_to_byte(DemodBuffer + ((i - 1) * 32), 32);
|
||||
}
|
||||
|
||||
PrintAndLogEx(INFO, "Preparing to clone NEDAP to T55x7 with card number: %u", cardnumber);
|
||||
PrintAndLogEx(SUCCESS, "Preparing to clone NEDAP to T55x7");
|
||||
print_blocks(blocks, 5);
|
||||
|
||||
PacketResponseNG resp;
|
||||
|
||||
// fast push mode
|
||||
conn.block_after_ACK = true;
|
||||
for (uint8_t i = 0; i < 5; i++) {
|
||||
if (i == 4) {
|
||||
for (uint8_t i = 0; i < max; i++) {
|
||||
if (i == max - 1) {
|
||||
// Disable fast mode on last packet
|
||||
conn.block_after_ACK = false;
|
||||
}
|
||||
|
|
@ -224,42 +477,41 @@ static int CmdLFNedapClone(const char *Cmd) {
|
|||
return PM3_ETIMEOUT;
|
||||
}
|
||||
}
|
||||
// TODO info correct?
|
||||
PrintAndLogEx(INFO, "The block 0 was changed (eXtended) which can be hard to detect. Configure it manually with");
|
||||
PrintAndLogEx(INFO, _YELLOW_("`lf t55xx config b 64 d BI i 1 o 32`") );
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
*/
|
||||
|
||||
static int CmdLFNedapSim(const char *Cmd) {
|
||||
|
||||
uint32_t cardnumber = 0, cn = 0;
|
||||
char cmdp = tolower(param_getchar(Cmd, 0));
|
||||
if (strlen(Cmd) == 0 || cmdp == 'h') return usage_lf_nedap_sim();
|
||||
|
||||
char cmdp = param_getchar(Cmd, 0);
|
||||
if (strlen(Cmd) == 0 || cmdp == 'h' || cmdp == 'H') return usage_lf_nedap_sim();
|
||||
|
||||
if (sscanf(Cmd, "%u", &cn) != 1) return usage_lf_nedap_sim();
|
||||
|
||||
cardnumber = (cn & 0x00FFFFFF);
|
||||
|
||||
uint8_t bs[128];
|
||||
memset(bs, 0x00, sizeof(bs));
|
||||
|
||||
if (getNedapBits(cardnumber, bs) != PM3_SUCCESS) {
|
||||
usage_to_be_displayed = usage_lf_nedap_sim;
|
||||
|
||||
int ret = CmdLfNedapGen(Cmd);
|
||||
if (ret != PM3_SUCCESS)
|
||||
return ret;
|
||||
|
||||
if ((DemodBufferLen != 128) && (DemodBufferLen != 64)) {
|
||||
PrintAndLogEx(ERR, "Error with tag bitstream generation.");
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
PrintAndLogEx(SUCCESS, "bin %s", sprint_bin_break(bs, 128, 32));
|
||||
PrintAndLogEx(SUCCESS, "Simulating Nedap - CardNumber: %u", cardnumber);
|
||||
PrintAndLogEx(SUCCESS, "Simulating NEDAP - Raw");
|
||||
CmdPrintDemodBuff("x");
|
||||
|
||||
// NEDAP, Biphase = 2, clock 64, inverted, (DIPhase == inverted BIphase)
|
||||
lf_asksim_t *payload = calloc(1, sizeof(lf_asksim_t) + sizeof(bs));
|
||||
lf_asksim_t *payload = calloc(1, sizeof(lf_asksim_t) + DemodBufferLen);
|
||||
payload->encoding = 2;
|
||||
payload->invert = 1;
|
||||
payload->separator = 0;
|
||||
payload->clock = 64;
|
||||
memcpy(payload->data, bs, sizeof(bs));
|
||||
memcpy(payload->data, DemodBuffer, DemodBufferLen);
|
||||
|
||||
clearCommandBuffer();
|
||||
SendCommandNG(CMD_LF_ASK_SIMULATE, (uint8_t *)payload, sizeof(lf_asksim_t) + sizeof(bs));
|
||||
SendCommandNG(CMD_LF_ASK_SIMULATE, (uint8_t *)payload, sizeof(lf_asksim_t) + DemodBufferLen);
|
||||
free(payload);
|
||||
|
||||
PacketResponseNG resp;
|
||||
|
|
@ -268,62 +520,17 @@ static int CmdLFNedapSim(const char *Cmd) {
|
|||
PrintAndLogEx(INFO, "Done");
|
||||
if (resp.status != PM3_EOPABORTED)
|
||||
return resp.status;
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
static int CmdLFNedapChk(const char *Cmd) {
|
||||
//301600714021BE
|
||||
uint8_t data[256] = { 0x30, 0x16, 0x00, 0x71, 0x40, 0x21, 0xBE};
|
||||
int len = 0;
|
||||
param_gethex_ex(Cmd, 0, data, &len);
|
||||
|
||||
len = (len == 0) ? 5 : len >> 1;
|
||||
|
||||
PrintAndLogEx(SUCCESS, "Input: [%d] %s", len, sprint_hex(data, len));
|
||||
|
||||
//uint8_t last = GetParity(data, EVEN, 62);
|
||||
//PrintAndLogEx(NORMAL, "TEST PARITY:: %d | %d ", DemodBuffer[62], last);
|
||||
|
||||
uint8_t cl = 0x1D, ch = 0x1D;
|
||||
|
||||
for (int i = len; i >= 0; --i) {
|
||||
uint8_t al = data[i];
|
||||
for (int j = 8; j > 0; --j) {
|
||||
|
||||
uint8_t bl = al ^ ch;
|
||||
//PrintAndLogEx(NORMAL, "BL %02x | CH %02x \n", al, ch);
|
||||
|
||||
uint8_t carry = (cl & 0x80) ? 1 : 0;
|
||||
cl <<= 1;
|
||||
|
||||
uint8_t temp = (ch & 0x80) ? 1 : 0;
|
||||
ch = (ch << 1) | carry;
|
||||
carry = temp;
|
||||
|
||||
carry = (al & 0x80) ? 1 : 0;
|
||||
al <<= 1;
|
||||
|
||||
carry = (bl & 0x80) ? 1 : 0;
|
||||
// bl <<= 1;
|
||||
|
||||
if (carry) {
|
||||
cl ^= 0x21;
|
||||
ch ^= 0x10;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
PrintAndLogEx(SUCCESS, "Nedap checksum: 0x%X", ((ch << 8) | cl));
|
||||
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
static command_t CommandTable[] = {
|
||||
{"help", CmdHelp, AlwaysAvailable, "this help"},
|
||||
{"demod", CmdLFNedapDemod, AlwaysAvailable, "demodulate an Nedap tag from the GraphBuffer"},
|
||||
{"read", CmdLFNedapRead, IfPm3Lf, "attempt to read and extract tag data"},
|
||||
// {"clone", CmdLFNedapClone, IfPm3Lf, "<Card Number> clone nedap tag"},
|
||||
{"sim", CmdLFNedapSim, IfPm3Lf, "simulate nedap tag"},
|
||||
{"chk", CmdLFNedapChk, AlwaysAvailable, "calculate Nedap Checksum <uid bytes>"},
|
||||
{"help", CmdHelp, AlwaysAvailable, "This help"},
|
||||
{"demod", CmdLFNedapDemod, AlwaysAvailable, "Demodulate Nedap tag from the GraphBuffer"},
|
||||
{"generate", CmdLfNedapGen, AlwaysAvailable, "Generate Nedap bitstream in DemodBuffer"},
|
||||
{"read", CmdLFNedapRead, IfPm3Lf, "Attempt to read and extract tag data from the antenna"},
|
||||
{"clone", CmdLFNedapClone, IfPm3Lf, "Clone Nedap tag to T55x7"},
|
||||
{"sim", CmdLFNedapSim, IfPm3Lf, "Simulate Nedap tag"},
|
||||
{NULL, NULL, NULL, NULL}
|
||||
};
|
||||
|
||||
|
|
@ -338,72 +545,6 @@ int CmdLFNedap(const char *Cmd) {
|
|||
return CmdsParse(CommandTable, Cmd);
|
||||
}
|
||||
|
||||
// find nedap preamble in already demoded data
|
||||
int detectNedap(uint8_t *dest, size_t *size) {
|
||||
//make sure buffer has data
|
||||
if (*size < 128) return -3;
|
||||
|
||||
size_t startIdx = 0;
|
||||
//uint8_t preamble[] = {1,1,1,1,1,1,1,1,1,0,0,0,1};
|
||||
uint8_t preamble[] = {1, 1, 1, 1, 1, 1, 1, 1, 1, 0};
|
||||
if (!preambleSearch(dest, preamble, sizeof(preamble), size, &startIdx))
|
||||
return -4; //preamble not found
|
||||
return (int) startIdx;
|
||||
}
|
||||
|
||||
int getNedapBits(uint32_t cn, uint8_t *nedapBits) {
|
||||
|
||||
uint8_t pre[128];
|
||||
memset(pre, 0x00, sizeof(pre));
|
||||
|
||||
// preamble 1111 1111 10 = 0xFF8
|
||||
num_to_bytebits(0xFF8, 12, pre);
|
||||
|
||||
// fixed tagtype code? 0010 1101 = 0x2D
|
||||
num_to_bytebits(0x2D, 8, pre + 10);
|
||||
|
||||
// 46 encrypted bits - UNKNOWN ALGO
|
||||
// -- 16 bits checksum. Should be 4x4 checksum, based on UID and 2 constant values.
|
||||
// -- 30 bits undocumented?
|
||||
//num_to_bytebits(cn, 46, pre+18);
|
||||
|
||||
//----from this part, the UID in clear text, with a 1bit ZERO as separator between bytes.
|
||||
pre[64] = 0;
|
||||
pre[73] = 0;
|
||||
pre[82] = 0;
|
||||
pre[91] = 0;
|
||||
pre[100] = 0;
|
||||
pre[109] = 0;
|
||||
pre[118] = 0;
|
||||
|
||||
// cardnumber (uid)
|
||||
num_to_bytebits((cn >> 0) & 0xFF, 8, pre + 65);
|
||||
num_to_bytebits((cn >> 8) & 0xFF, 8, pre + 74);
|
||||
num_to_bytebits((cn >> 16) & 0xFF, 8, pre + 83);
|
||||
|
||||
// two ?
|
||||
num_to_bytebits(0, 8, pre + 92);
|
||||
num_to_bytebits(0, 8, pre + 101);
|
||||
|
||||
// chksum
|
||||
num_to_bytebits((0 >> 0) & 0xFF, 8, pre + 110);
|
||||
num_to_bytebits((0 >> 8) & 0xFF, 8, pre + 119);
|
||||
|
||||
pre[63] = GetParity(pre, EVEN, 63);
|
||||
pre[127] = GetParity(pre + 64, EVEN, 63);
|
||||
|
||||
memcpy(nedapBits, pre, 128);
|
||||
|
||||
// 1111111110001011010000010110100011001001000010110101001101011001000110011010010000000000100001110001001000000001000101011100111
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
/*
|
||||
- UID: 001630
|
||||
- i: 4071
|
||||
- Checksum2 BE21
|
||||
*/
|
||||
//GetParity( uint8_t *bits, uint8_t type, int length)
|
||||
|
||||
int demodNedap(void) {
|
||||
return CmdLFNedapDemod("");
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue