Merge branch 'master' into apdufuzz
This commit is contained in:
@@ -624,7 +624,7 @@ static int CmdHFiClassReader(const char *Cmd) {
|
||||
CLIParserInit(&ctx, "hf iclass reader",
|
||||
"Act as a iCLASS reader. Look for iCLASS tags until Enter or the pm3 button is pressed",
|
||||
"hf iclass reader -@ -> continuous reader mode"
|
||||
);
|
||||
);
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
@@ -1700,7 +1700,7 @@ static int CmdHFiClassRestore(const char *Cmd) {
|
||||
"hf iclass restore -f hf-iclass-AA162D30F8FF12F1-dump.bin --first 6 --last 18 --ki 0\n"
|
||||
"hf iclass restore -f hf-iclass-AA162D30F8FF12F1-dump.bin --first 6 --last 18 --ki 0 --elite\n"
|
||||
"hf iclass restore -f hf-iclass-AA162D30F8FF12F1-dump.bin --first 6 --last 18 -k 1122334455667788 --elite\n"
|
||||
);
|
||||
);
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
@@ -3318,12 +3318,12 @@ static int CmdHFiClassPermuteKey(const char *Cmd) {
|
||||
|
||||
static int CmdHFiClassEncode(const char *Cmd) {
|
||||
|
||||
CLIParserContext *ctx;
|
||||
CLIParserContext *ctx;
|
||||
CLIParserInit(&ctx, "hf iclass encode",
|
||||
"Encode binary wiegand to block 7",
|
||||
"hf iclass encode --bin 10001111100000001010100011 --ki 0 -> FC 31 CN 337\n"
|
||||
"hf iclass encode --bin 10001111100000001010100011 --ki 0 --elite -> FC 31 CN 337, writing w elite key"
|
||||
);
|
||||
);
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
@@ -3422,7 +3422,7 @@ static int CmdHFiClassEncode(const char *Cmd) {
|
||||
}
|
||||
// add binary sentinel bit.
|
||||
pushBit(&bout, 1);
|
||||
|
||||
|
||||
// convert binary string to hex bytes
|
||||
for (int i = 0; i < bin_len; i++) {
|
||||
char c = bin[i];
|
||||
@@ -3449,11 +3449,11 @@ static int CmdHFiClassEncode(const char *Cmd) {
|
||||
|
||||
int isok = PM3_SUCCESS;
|
||||
// write
|
||||
for (uint8_t i=0; i<4; i++) {
|
||||
isok = iclass_write_block(6 + i, credential + (i*8), key, use_credit_key, elite, rawkey, false, false, auth);
|
||||
for (uint8_t i = 0; i < 4; i++) {
|
||||
isok = iclass_write_block(6 + i, credential + (i * 8), key, use_credit_key, elite, rawkey, false, false, auth);
|
||||
switch (isok) {
|
||||
case PM3_SUCCESS:
|
||||
PrintAndLogEx(SUCCESS, "Write block %d/0x0%x ( " _GREEN_("ok") " ) --> " _YELLOW_("%s"), 6 + i, 6 + i, sprint_hex_inrow(credential + (i*8), 8));
|
||||
PrintAndLogEx(SUCCESS, "Write block %d/0x0%x ( " _GREEN_("ok") " ) --> " _YELLOW_("%s"), 6 + i, 6 + i, sprint_hex_inrow(credential + (i * 8), 8));
|
||||
break;
|
||||
default:
|
||||
PrintAndLogEx(SUCCESS, "Write block %d/0x0%x ( " _RED_("fail") " )", 6 + i, 6 + i);
|
||||
|
||||
@@ -276,7 +276,7 @@ static int CmdHFMFPInfo(const char *Cmd) {
|
||||
arg_param_end
|
||||
};
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
|
||||
|
||||
PrintAndLogEx(NORMAL, "");
|
||||
PrintAndLogEx(INFO, "--- " _CYAN_("Tag Information") " ---------------------------");
|
||||
PrintAndLogEx(INFO, "-------------------------------------------------------------");
|
||||
|
||||
@@ -510,7 +510,7 @@ static int CmdAWIDBrute(const char *Cmd) {
|
||||
break;
|
||||
}
|
||||
|
||||
|
||||
|
||||
// truncate card number
|
||||
if ((cn & 0xFFFF) != cn) {
|
||||
cn &= 0xFFFF;
|
||||
@@ -550,7 +550,7 @@ static int CmdAWIDBrute(const char *Cmd) {
|
||||
if (cn > 1) {
|
||||
if (down > 1) {
|
||||
if (sendTry(fmtlen, fc, --down, delay, bits, size, verbose) != PM3_SUCCESS) {
|
||||
return PM3_ESOFT;
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -190,9 +190,9 @@ static int CmdDestronClone(const char *Cmd) {
|
||||
blocks[1] = (blocks[1] & 0xFFFF) | 0xAAE20000;
|
||||
|
||||
PrintAndLogEx(INFO, "Preparing to clone Destron tag to " _YELLOW_("%s") " with ID: " _YELLOW_("%s")
|
||||
, cardtype
|
||||
, sprint_hex_inrow(data, datalen)
|
||||
);
|
||||
, cardtype
|
||||
, sprint_hex_inrow(data, datalen)
|
||||
);
|
||||
|
||||
|
||||
print_blocks(blocks, ARRAYLEN(blocks));
|
||||
|
||||
@@ -118,7 +118,7 @@ void printEM410x(uint32_t hi, uint64_t id, bool verbose) {
|
||||
if (hi) {
|
||||
PrintAndLogEx(SUCCESS, "EM 410x ID "_GREEN_("%06X%016" PRIX64), hi, id);
|
||||
} else {
|
||||
PrintAndLogEx(SUCCESS, "EM 410x ID "_GREEN_("%010" PRIX64), id);
|
||||
PrintAndLogEx(SUCCESS, "EM 410x ID "_GREEN_("%010" PRIX64), id);
|
||||
}
|
||||
return;
|
||||
}
|
||||
@@ -395,7 +395,7 @@ static int CmdEM410xReader(const char *Cmd) {
|
||||
|
||||
// emulate an EM410X tag
|
||||
static int CmdEM410xSim(const char *Cmd) {
|
||||
|
||||
|
||||
CLIParserContext *ctx;
|
||||
CLIParserInit(&ctx, "lf em 410x sim",
|
||||
"Enables simulation of EM 410x card.\n"
|
||||
@@ -433,7 +433,7 @@ static int CmdEM410xSim(const char *Cmd) {
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
static int CmdEM410xBrute(const char *Cmd) {
|
||||
static int CmdEM410xBrute(const char *Cmd) {
|
||||
CLIParserContext *ctx;
|
||||
CLIParserInit(&ctx, "lf em 410x brute",
|
||||
"bruteforcing by emulating EM 410x tag",
|
||||
@@ -452,10 +452,10 @@ static int CmdEM410xBrute(const char *Cmd) {
|
||||
};
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
||||
|
||||
// clock default 64 in EM410x
|
||||
// clock default 64 in EM410x
|
||||
uint32_t clk = arg_get_u32_def(ctx, 1, 64);
|
||||
|
||||
// default pause time: 1 second
|
||||
// default pause time: 1 second
|
||||
uint32_t delay = arg_get_u32_def(ctx, 2, 1000);
|
||||
|
||||
int fnlen = 0;
|
||||
@@ -467,7 +467,7 @@ static int CmdEM410xBrute(const char *Cmd) {
|
||||
PrintAndLogEx(ERR, "Error: Please specify a filename");
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
|
||||
uint32_t uidcnt = 0;
|
||||
uint8_t stUidBlock = 20;
|
||||
uint8_t *p = NULL;
|
||||
@@ -543,10 +543,10 @@ static int CmdEM410xBrute(const char *Cmd) {
|
||||
|
||||
memcpy(testuid, uidblock + 5 * c, 5);
|
||||
PrintAndLogEx(INFO, "Bruteforce %d / %d: simulating UID " _YELLOW_("%s")
|
||||
, c + 1
|
||||
, uidcnt
|
||||
, sprint_hex_inrow(testuid, sizeof(testuid))
|
||||
);
|
||||
, c + 1
|
||||
, uidcnt
|
||||
, sprint_hex_inrow(testuid, sizeof(testuid))
|
||||
);
|
||||
|
||||
em410x_construct_emul_graph(testuid, clk);
|
||||
|
||||
@@ -585,7 +585,7 @@ static int CmdEM410xClone(const char *Cmd) {
|
||||
CLIParserContext *ctx;
|
||||
CLIParserInit(&ctx, "lf em 410x clone",
|
||||
"Writes EM410x ID to a T55x7 or Q5/T5555 tag",
|
||||
"lf em 410x clone --id 0F0368568B -> write id to T55x7 tag\n"
|
||||
"lf em 410x clone --id 0F0368568B -> write id to T55x7 tag\n"
|
||||
"lf em 410x clone --id 0F0368568B --q5 -> write id to Q5/T5555 tag"
|
||||
);
|
||||
|
||||
@@ -598,7 +598,7 @@ static int CmdEM410xClone(const char *Cmd) {
|
||||
};
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
||||
|
||||
// clock default 64 in EM410x
|
||||
// clock default 64 in EM410x
|
||||
uint32_t clk = arg_get_u32_def(ctx, 1, 64);
|
||||
int uid_len = 0;
|
||||
uint8_t uid[5] = {0};
|
||||
|
||||
@@ -773,7 +773,7 @@ int CmdEM4x05Write(const char *Cmd) {
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_int0("a", "addr", "<dec>", "memory address to write to. (0-13)"),
|
||||
arg_str1("d", "data", "<hex>", "data to write, 4 bytes hex"),
|
||||
arg_str1("d", "data", "<hex>", "data to write, 4 bytes hex"),
|
||||
arg_str0("p", "pwd", "<hex>", "optional - password, 4 bytes hex"),
|
||||
arg_lit0(NULL, "po", "protect operation"),
|
||||
arg_param_end
|
||||
@@ -784,14 +784,14 @@ int CmdEM4x05Write(const char *Cmd) {
|
||||
uint64_t inputpwd = arg_get_u64_hexstr_def(ctx, 3, 0xFFFFFFFFFFFFFFFF);
|
||||
bool protect_operation = arg_get_lit(ctx, 4);
|
||||
CLIParserFree(ctx);
|
||||
|
||||
|
||||
if ((addr > 13) && (protect_operation == false)) {
|
||||
PrintAndLogEx(WARNING, "Address must be between 0 and 13");
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
bool use_pwd = false;
|
||||
uint32_t pwd = ( inputpwd != 0xFFFFFFFFFFFFFFFF) ? (inputpwd & 0xFFFFFFFF) : 0;
|
||||
bool use_pwd = false;
|
||||
uint32_t pwd = (inputpwd != 0xFFFFFFFFFFFFFFFF) ? (inputpwd & 0xFFFFFFFF) : 0;
|
||||
if (pwd == 0xFFFFFFFF) {
|
||||
if (protect_operation)
|
||||
PrintAndLogEx(INFO, "Writing protection words data %08X", data);
|
||||
@@ -807,14 +807,14 @@ int CmdEM4x05Write(const char *Cmd) {
|
||||
|
||||
int res = PM3_SUCCESS;
|
||||
// set Protect Words
|
||||
if (protect_operation) {
|
||||
if (protect_operation) {
|
||||
res = em4x05_protect(pwd, use_pwd, data);
|
||||
if ( res != PM3_SUCCESS) {
|
||||
if (res != PM3_SUCCESS) {
|
||||
return res;
|
||||
}
|
||||
} else {
|
||||
res = em4x05_write_word_ext(addr, pwd, use_pwd, data);
|
||||
if ( res != PM3_SUCCESS) {
|
||||
if (res != PM3_SUCCESS) {
|
||||
return res;
|
||||
}
|
||||
}
|
||||
@@ -888,25 +888,25 @@ int CmdEM4x05Wipe(const char *Cmd) {
|
||||
|
||||
bool use_pwd = false;
|
||||
uint32_t pwd = 0;
|
||||
if ( inputpwd != 0xFFFFFFFFFFFFFFFF) {
|
||||
if (inputpwd != 0xFFFFFFFFFFFFFFFF) {
|
||||
pwd = (inputpwd & 0xFFFFFFFF);
|
||||
use_pwd = true;
|
||||
}
|
||||
// block 0 : User Data or Chip Info
|
||||
int res = em4x05_write_word_ext(0, pwd, use_pwd, chip_info);
|
||||
if ( res != PM3_SUCCESS) {
|
||||
if (res != PM3_SUCCESS) {
|
||||
return res;
|
||||
}
|
||||
|
||||
// block 1 : UID - this should be read only for EM4205 and EM4305 not sure about others
|
||||
res = em4x05_write_word_ext(1, pwd, use_pwd, chip_UID);
|
||||
if ( res != PM3_SUCCESS) {
|
||||
if (res != PM3_SUCCESS) {
|
||||
PrintAndLogEx(INFO, "UID block write failed");
|
||||
}
|
||||
|
||||
// block 2 : password
|
||||
res = em4x05_write_word_ext(2, pwd, use_pwd, block_data);
|
||||
if ( res != PM3_SUCCESS) {
|
||||
if (res != PM3_SUCCESS) {
|
||||
return res;
|
||||
}
|
||||
|
||||
@@ -914,20 +914,20 @@ int CmdEM4x05Wipe(const char *Cmd) {
|
||||
pwd = block_data;
|
||||
// block 3 : user data
|
||||
res = em4x05_write_word_ext(3, pwd, use_pwd, block_data);
|
||||
if ( res != PM3_SUCCESS) {
|
||||
if (res != PM3_SUCCESS) {
|
||||
return res;
|
||||
}
|
||||
|
||||
// block 4 : config
|
||||
res = em4x05_write_word_ext(4, pwd, use_pwd, config);
|
||||
if ( res != PM3_SUCCESS) {
|
||||
if (res != PM3_SUCCESS) {
|
||||
return res;
|
||||
}
|
||||
|
||||
// Remainder of user/data blocks
|
||||
for (addr = 5; addr < 14; addr++) {// Clear user data blocks
|
||||
res = em4x05_write_word_ext(addr, pwd, use_pwd, block_data);
|
||||
if ( res != PM3_SUCCESS) {
|
||||
if (res != PM3_SUCCESS) {
|
||||
return res;
|
||||
}
|
||||
}
|
||||
@@ -2146,4 +2146,4 @@ static int CmdHelp(const char *Cmd) {
|
||||
int CmdLFEM4X05(const char *Cmd) {
|
||||
clearCommandBuffer();
|
||||
return CmdsParse(CommandTable, Cmd);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -28,7 +28,7 @@ static void prepare_result(const uint8_t *data, int fwr, int lwr, em4x50_word_t
|
||||
// restructure received result in "em4x50_word_t" structure
|
||||
for (int i = fwr; i <= lwr; i++) {
|
||||
for (int j = 0; j < 4; j++) {
|
||||
words[i].byte[j] = data[i * 4 + (3 - j)];
|
||||
words[i].byte[j] = data[i * 4 + (3 - j)];
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -131,7 +131,7 @@ static int em4x50_load_file(const char *filename, uint8_t *data, size_t data_len
|
||||
|
||||
int res = 0;
|
||||
uint32_t serial = 0x0, device_id = 0x0;
|
||||
|
||||
|
||||
if (str_endswith(filename, ".eml"))
|
||||
res = loadFileEML(filename, data, bytes_read) != PM3_SUCCESS;
|
||||
else if (str_endswith(filename, ".json"))
|
||||
@@ -202,7 +202,7 @@ int CmdEM4x50ELoad(const char *Cmd) {
|
||||
// upload to emulator memory
|
||||
PrintAndLogEx(INFO, "Uploading dump " _YELLOW_("%s") " to emulator memory", filename);
|
||||
em4x50_seteml(data, 0, DUMP_FILESIZE);
|
||||
|
||||
|
||||
PrintAndLogEx(INFO, "Done");
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
@@ -236,7 +236,7 @@ int CmdEM4x50ESave(const char *Cmd) {
|
||||
PrintAndLogEx(WARNING, "Fail, transfer from device time-out");
|
||||
return PM3_ETIMEOUT;
|
||||
}
|
||||
|
||||
|
||||
// valid em4x50 data?
|
||||
uint32_t serial = bytes_to_num(data + 4 * EM4X50_DEVICE_SERIAL, 4);
|
||||
uint32_t device_id = bytes_to_num(data + 4 * EM4X50_DEVICE_ID, 4);
|
||||
@@ -244,7 +244,7 @@ int CmdEM4x50ESave(const char *Cmd) {
|
||||
PrintAndLogEx(WARNING, "No valid em4x50 data in flash memory.");
|
||||
return PM3_ENODATA;
|
||||
}
|
||||
|
||||
|
||||
// user supplied filename?
|
||||
if (fnlen == 0) {
|
||||
PrintAndLogEx(INFO, "Using UID as filename");
|
||||
@@ -272,7 +272,7 @@ int CmdEM4x50Login(const char *Cmd) {
|
||||
arg_param_end
|
||||
};
|
||||
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
int pwd_len = 0;
|
||||
uint8_t pwd[4] = {0x0};
|
||||
CLIGetHexWithReturn(ctx, 1, pwd, &pwd_len);
|
||||
@@ -281,7 +281,7 @@ int CmdEM4x50Login(const char *Cmd) {
|
||||
if (pwd_len != 4) {
|
||||
PrintAndLogEx(FAILED, "password length must be 4 bytes");
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
}
|
||||
|
||||
uint32_t password = BYTES2UINT32(pwd);
|
||||
|
||||
@@ -315,30 +315,30 @@ int CmdEM4x50Brute(const char *Cmd) {
|
||||
arg_param_end
|
||||
};
|
||||
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
int first_len = 0;
|
||||
uint8_t first[4] = {0,0,0,0};
|
||||
uint8_t first[4] = {0, 0, 0, 0};
|
||||
CLIGetHexWithReturn(ctx, 1, first, &first_len);
|
||||
int last_len = 0;
|
||||
uint8_t last[4] = {0,0,0,0};
|
||||
uint8_t last[4] = {0, 0, 0, 0};
|
||||
CLIGetHexWithReturn(ctx, 2, last, &last_len);
|
||||
CLIParserFree(ctx);
|
||||
|
||||
if (first_len != 4) {
|
||||
PrintAndLogEx(FAILED, "password length must be 4 bytes");
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
if (last_len != 4) {
|
||||
PrintAndLogEx(FAILED, "password length must be 4 bytes");
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
}
|
||||
if (last_len != 4) {
|
||||
PrintAndLogEx(FAILED, "password length must be 4 bytes");
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
em4x50_data_t etd;
|
||||
etd.password1 = BYTES2UINT32(first);
|
||||
etd.password2 = BYTES2UINT32(last);
|
||||
|
||||
// 27 passwords/second (empirical value)
|
||||
const int speed = 27;
|
||||
const int speed = 27;
|
||||
|
||||
// print some information
|
||||
int no_iter = etd.password2 - etd.password1 + 1;
|
||||
@@ -348,10 +348,10 @@ int CmdEM4x50Brute(const char *Cmd) {
|
||||
|
||||
dur_s -= dur_h * 3600 + dur_m * 60;
|
||||
PrintAndLogEx(INFO, "Trying %i passwords in range [0x%08x, 0x%08x]"
|
||||
, no_iter
|
||||
, etd.password1
|
||||
, etd.password2
|
||||
);
|
||||
, no_iter
|
||||
, etd.password1
|
||||
, etd.password2
|
||||
);
|
||||
PrintAndLogEx(INFO, "Estimated duration: %ih%im%is", dur_h, dur_m, dur_s);
|
||||
|
||||
// start
|
||||
@@ -390,7 +390,7 @@ int CmdEM4x50Chk(const char *Cmd) {
|
||||
char filename[FILE_PATH_SIZE] = {0};
|
||||
CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
|
||||
CLIParserFree(ctx);
|
||||
|
||||
|
||||
if (IfPm3Flash() == false) {
|
||||
PrintAndLogEx(WARNING, "no flash memory available");
|
||||
return PM3_EFLASH;
|
||||
@@ -410,17 +410,17 @@ int CmdEM4x50Chk(const char *Cmd) {
|
||||
int res = loadFileDICTIONARY(filename, data, &datalen, 4, &key_count);
|
||||
if (res || !key_count)
|
||||
return PM3_EFILE;
|
||||
|
||||
|
||||
PrintAndLogEx(INFO, "You can cancel this operation by pressing the pm3 button");
|
||||
|
||||
int status = PM3_EFAILED;
|
||||
int keyblock = 2000; // block with 2000 bytes -> 500 keys
|
||||
uint8_t destfn[32] = "em4x50_chk.bin";
|
||||
|
||||
PacketResponseNG resp;
|
||||
PacketResponseNG resp;
|
||||
int bytes_remaining = datalen;
|
||||
while (bytes_remaining > 0) {
|
||||
|
||||
|
||||
PrintAndLogEx(INPLACE, "Remaining keys: %i ", bytes_remaining / 4);
|
||||
|
||||
// upload to flash.
|
||||
@@ -434,7 +434,7 @@ int CmdEM4x50Chk(const char *Cmd) {
|
||||
clearCommandBuffer();
|
||||
SendCommandNG(CMD_LF_EM4X50_CHK, destfn, sizeof(destfn));
|
||||
WaitForResponseTimeoutW(CMD_LF_EM4X50_CHK, &resp, -1, false);
|
||||
|
||||
|
||||
status = resp.status;
|
||||
if ((status == PM3_SUCCESS) || (status == PM3_EOPABORTED))
|
||||
break;
|
||||
@@ -444,7 +444,7 @@ int CmdEM4x50Chk(const char *Cmd) {
|
||||
}
|
||||
|
||||
PrintAndLogEx(NORMAL, "");
|
||||
|
||||
|
||||
// print response
|
||||
if (status == PM3_SUCCESS) {
|
||||
PrintAndLogEx(SUCCESS, "Key " _GREEN_("found: %02x %02x %02x %02x"),
|
||||
@@ -452,7 +452,7 @@ int CmdEM4x50Chk(const char *Cmd) {
|
||||
resp.data.asBytes[2],
|
||||
resp.data.asBytes[1],
|
||||
resp.data.asBytes[0]
|
||||
);
|
||||
);
|
||||
} else {
|
||||
PrintAndLogEx(FAILED, "No key found");
|
||||
}
|
||||
@@ -536,7 +536,7 @@ int CmdEM4x50Read(const char *Cmd) {
|
||||
};
|
||||
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
|
||||
|
||||
int addr = arg_get_int_def(ctx, 1, 0);
|
||||
int pwd_len = 0;
|
||||
uint8_t pwd[4] = {0x0};
|
||||
@@ -545,7 +545,7 @@ int CmdEM4x50Read(const char *Cmd) {
|
||||
|
||||
if (addr <= 0 || addr >= EM4X50_NO_WORDS) {
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
}
|
||||
|
||||
em4x50_data_t etd;
|
||||
|
||||
@@ -587,11 +587,11 @@ int CmdEM4x50Info(const char *Cmd) {
|
||||
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
int pwd_len = 0;
|
||||
uint8_t pwd[4] = {0x0};
|
||||
uint8_t pwd[4] = {0x0};
|
||||
CLIGetHexWithReturn(ctx, 1, pwd, &pwd_len);
|
||||
CLIParserFree(ctx);
|
||||
|
||||
em4x50_data_t etd = {.pwd_given = false};
|
||||
em4x50_data_t etd = {.pwd_given = false};
|
||||
if (pwd_len) {
|
||||
if (pwd_len != 4) {
|
||||
PrintAndLogEx(FAILED, "password length must be 4 bytes instead of %d", pwd_len);
|
||||
@@ -610,7 +610,7 @@ int CmdEM4x50Info(const char *Cmd) {
|
||||
return PM3_ETIMEOUT;
|
||||
}
|
||||
|
||||
if ( resp.status == PM3_SUCCESS)
|
||||
if (resp.status == PM3_SUCCESS)
|
||||
print_info_result(resp.data.asBytes);
|
||||
else
|
||||
PrintAndLogEx(FAILED, "Reading tag " _RED_("failed"));
|
||||
@@ -666,7 +666,7 @@ int CmdEM4x50Reader(const char *Cmd) {
|
||||
|
||||
PrintAndLogEx(INFO, _GREEN_(" %s") "| %s", sprint_hex(words[i].byte, 4), r);
|
||||
}
|
||||
|
||||
|
||||
PrintAndLogEx(INFO, "-------------+-------------");
|
||||
}
|
||||
} while (cm && !kbd_enter_pressed());
|
||||
@@ -771,11 +771,11 @@ int CmdEM4x50Write(const char *Cmd) {
|
||||
arg_str0("p", "pwd", "<hex>", "password, 4 bytes, lsb"),
|
||||
arg_param_end
|
||||
};
|
||||
|
||||
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
|
||||
int addr = arg_get_int_def(ctx, 1, 0);
|
||||
|
||||
|
||||
int word_len = 0;
|
||||
uint8_t word[4] = {0x0};
|
||||
CLIGetHexWithReturn(ctx, 2, word, &word_len);
|
||||
@@ -784,18 +784,18 @@ int CmdEM4x50Write(const char *Cmd) {
|
||||
uint8_t pwd[4] = {0x0};
|
||||
CLIGetHexWithReturn(ctx, 3, pwd, &pwd_len);
|
||||
CLIParserFree(ctx);
|
||||
|
||||
|
||||
if (addr <= 0 || addr >= EM4X50_NO_WORDS) {
|
||||
PrintAndLogEx(FAILED, "address has to be within range [0, 31]");
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
if (word_len != 4) {
|
||||
PrintAndLogEx(FAILED, "word/data length must be 4 bytes instead of %d", word_len);
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
em4x50_data_t etd = {.pwd_given = false};
|
||||
em4x50_data_t etd = {.pwd_given = false};
|
||||
if (pwd_len) {
|
||||
if (pwd_len != 4) {
|
||||
PrintAndLogEx(FAILED, "password length must be 4 bytes instead of %d", pwd_len);
|
||||
@@ -853,7 +853,7 @@ int CmdEM4x50WritePwd(const char *Cmd) {
|
||||
arg_str1("n", "new", "<hex>", "new password, 4 hex bytes, lsb"),
|
||||
arg_param_end
|
||||
};
|
||||
|
||||
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
int pwd_len = 0;
|
||||
uint8_t pwd[4] = {0x0};
|
||||
@@ -865,7 +865,7 @@ int CmdEM4x50WritePwd(const char *Cmd) {
|
||||
|
||||
CLIParserFree(ctx);
|
||||
|
||||
em4x50_data_t etd;
|
||||
em4x50_data_t etd;
|
||||
if (pwd_len != 4) {
|
||||
PrintAndLogEx(FAILED, "password length must be 4 bytes instead of %d", pwd_len);
|
||||
return PM3_EINVARG;
|
||||
@@ -898,9 +898,9 @@ int CmdEM4x50WritePwd(const char *Cmd) {
|
||||
}
|
||||
|
||||
PrintAndLogEx(SUCCESS, "Writing new password %s (%s)"
|
||||
, sprint_hex_inrow(npwd, sizeof(npwd))
|
||||
, _GREEN_("ok")
|
||||
);
|
||||
, sprint_hex_inrow(npwd, sizeof(npwd))
|
||||
, _GREEN_("ok")
|
||||
);
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
@@ -919,7 +919,7 @@ int CmdEM4x50Wipe(const char *Cmd) {
|
||||
arg_param_end
|
||||
};
|
||||
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
int pwd_len = 0;
|
||||
uint8_t pwd[4] = {0x0};
|
||||
CLIGetHexWithReturn(ctx, 1, pwd, &pwd_len);
|
||||
@@ -935,7 +935,7 @@ int CmdEM4x50Wipe(const char *Cmd) {
|
||||
|
||||
etd.password1 = BYTES2UINT32(pwd);
|
||||
etd.pwd_given = true;
|
||||
|
||||
|
||||
// clear password
|
||||
PacketResponseNG resp;
|
||||
clearCommandBuffer();
|
||||
@@ -954,13 +954,13 @@ int CmdEM4x50Wipe(const char *Cmd) {
|
||||
|
||||
// from now on new password 0x0
|
||||
etd.password1 = 0x0;
|
||||
|
||||
|
||||
// clear data (words 1 to 31)
|
||||
for (int i = 1; i < EM4X50_DEVICE_SERIAL; i++) {
|
||||
|
||||
// no login necessary for blocks 3 to 31
|
||||
etd.pwd_given = (i <= EM4X50_CONTROL);
|
||||
|
||||
|
||||
PrintAndLogEx(INPLACE, "Wiping block %i", i);
|
||||
|
||||
etd.addresses = i << 8 | i;
|
||||
@@ -971,7 +971,7 @@ int CmdEM4x50Wipe(const char *Cmd) {
|
||||
return PM3_ETIMEOUT;
|
||||
}
|
||||
|
||||
if ( resp.status != PM3_SUCCESS) {
|
||||
if (resp.status != PM3_SUCCESS) {
|
||||
PrintAndLogEx(NORMAL, "");
|
||||
PrintAndLogEx(FAILED, "Wiping data " _RED_("failed"));
|
||||
return PM3_ESOFT;
|
||||
@@ -1002,7 +1002,7 @@ int CmdEM4x50Restore(const char *Cmd) {
|
||||
arg_param_end
|
||||
};
|
||||
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
|
||||
int uidLen = 0;
|
||||
uint8_t uid[4] = {0x0};
|
||||
@@ -1057,7 +1057,7 @@ int CmdEM4x50Restore(const char *Cmd) {
|
||||
|
||||
etd.addresses = i << 8 | i;
|
||||
etd.word = reflect32(BYTES2UINT32((data + 4 * i)));
|
||||
|
||||
|
||||
PacketResponseNG resp;
|
||||
clearCommandBuffer();
|
||||
SendCommandNG(CMD_LF_EM4X50_WRITE, (uint8_t *)&etd, sizeof(etd));
|
||||
@@ -1074,7 +1074,7 @@ int CmdEM4x50Restore(const char *Cmd) {
|
||||
}
|
||||
}
|
||||
|
||||
PrintAndLogEx(NORMAL, "");
|
||||
PrintAndLogEx(NORMAL, "");
|
||||
PrintAndLogEx(INFO, "Done");
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
@@ -1118,10 +1118,10 @@ static command_t CommandTable[] = {
|
||||
{"login", CmdEM4x50Login, IfPm3EM4x50, "login into EM4x50"},
|
||||
{"rdbl", CmdEM4x50Read, IfPm3EM4x50, "read word data from EM4x50"},
|
||||
{"wrbl", CmdEM4x50Write, IfPm3EM4x50, "write word data to EM4x50"},
|
||||
{"writepwd",CmdEM4x50WritePwd, IfPm3EM4x50, "change password of EM4x50"},
|
||||
{"writepwd", CmdEM4x50WritePwd, IfPm3EM4x50, "change password of EM4x50"},
|
||||
{"wipe", CmdEM4x50Wipe, IfPm3EM4x50, "wipe EM4x50 tag"},
|
||||
{"reader", CmdEM4x50Reader, IfPm3EM4x50, "show standard read mode data of EM4x50"},
|
||||
{"restore",CmdEM4x50Restore, IfPm3EM4x50, "restore EM4x50 dump to tag"},
|
||||
{"restore", CmdEM4x50Restore, IfPm3EM4x50, "restore EM4x50 dump to tag"},
|
||||
{"sim", CmdEM4x50Sim, IfPm3EM4x50, "simulate EM4x50 tag"},
|
||||
{"eload", CmdEM4x50ELoad, IfPm3EM4x50, "upload dump of EM4x50 to flash memory"},
|
||||
{"esave", CmdEM4x50ESave, IfPm3EM4x50, "save flash memory to file"},
|
||||
|
||||
@@ -31,26 +31,26 @@ static void print_info_result(uint8_t *data) {
|
||||
// data section
|
||||
PrintAndLogEx(NORMAL, "");
|
||||
PrintAndLogEx(INFO, _YELLOW_("EM4x70 data:"));
|
||||
|
||||
for(int i=1; i <= 32; i+=2) {
|
||||
PrintAndLogEx(NORMAL, "%02X %02X", data[32-i], data[32-i-1]);
|
||||
|
||||
for (int i = 1; i <= 32; i += 2) {
|
||||
PrintAndLogEx(NORMAL, "%02X %02X", data[32 - i], data[32 - i - 1]);
|
||||
}
|
||||
PrintAndLogEx(NORMAL, "Tag ID: %02X %02X %02X %02X", data[7], data[6], data[5], data[4]);
|
||||
PrintAndLogEx(NORMAL, "Lockbit 0: %d %s", (data[3] & 0x40) ? 1:0, (data[3] & 0x40) ? "LOCKED":"UNLOCKED");
|
||||
PrintAndLogEx(NORMAL, "Lockbit 1: %d", (data[3] & 0x80) ? 1:0);
|
||||
PrintAndLogEx(NORMAL, "Lockbit 0: %d %s", (data[3] & 0x40) ? 1 : 0, (data[3] & 0x40) ? "LOCKED" : "UNLOCKED");
|
||||
PrintAndLogEx(NORMAL, "Lockbit 1: %d", (data[3] & 0x80) ? 1 : 0);
|
||||
PrintAndLogEx(NORMAL, "");
|
||||
|
||||
}
|
||||
|
||||
int em4x70_info(void) {
|
||||
|
||||
|
||||
em4x70_data_t edata = {
|
||||
.parity = false // TODO: try both? or default to true
|
||||
};
|
||||
|
||||
clearCommandBuffer();
|
||||
SendCommandNG(CMD_LF_EM4X70_INFO, (uint8_t *)&edata, sizeof(edata));
|
||||
|
||||
|
||||
PacketResponseNG resp;
|
||||
if (!WaitForResponseTimeout(CMD_LF_EM4X70_INFO, &resp, TIMEOUT)) {
|
||||
PrintAndLogEx(WARNING, "(em4x70) timeout while waiting for reply.");
|
||||
@@ -80,18 +80,18 @@ int CmdEM4x70Info(const char *Cmd) {
|
||||
|
||||
CLIParserContext *ctx;
|
||||
|
||||
CLIParserInit(&ctx, "lf em 4x10 info",
|
||||
CLIParserInit(&ctx, "lf em 4x70 info",
|
||||
"Tag Information EM4x70\n"
|
||||
" Tag variants include ID48 automotive transponder.\n"
|
||||
" ID48 does not use command parity (default).\n"
|
||||
" V4070 and EM4170 do require parity bit.",
|
||||
"lf em 4x70 info\n"
|
||||
"lf em 4x70 info -p -> adds parity bit to command\n"
|
||||
);
|
||||
"lf em 4x70 info --par -> adds parity bit to command\n"
|
||||
);
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_lit0("p", "parity", "Add parity bit when sending commands"),
|
||||
arg_lit0(NULL, "par", "Add parity bit when sending commands"),
|
||||
arg_param_end
|
||||
};
|
||||
|
||||
@@ -104,7 +104,7 @@ int CmdEM4x70Info(const char *Cmd) {
|
||||
|
||||
PacketResponseNG resp;
|
||||
if (!WaitForResponseTimeout(CMD_LF_EM4X70_INFO, &resp, TIMEOUT)) {
|
||||
PrintAndLogEx(WARNING, "timeout while waiting for reply.");
|
||||
PrintAndLogEx(WARNING, "Timeout while waiting for reply.");
|
||||
return PM3_ETIMEOUT;
|
||||
}
|
||||
|
||||
@@ -113,7 +113,7 @@ int CmdEM4x70Info(const char *Cmd) {
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
PrintAndLogEx(FAILED, "reading tag " _RED_("failed"));
|
||||
PrintAndLogEx(FAILED, "Reading " _RED_("Failed"));
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
@@ -124,26 +124,26 @@ int CmdEM4x70Write(const char *Cmd) {
|
||||
|
||||
CLIParserContext *ctx;
|
||||
|
||||
CLIParserInit(&ctx, "lf em 4x10 write",
|
||||
CLIParserInit(&ctx, "lf em 4x70 write",
|
||||
"Write EM4x70\n",
|
||||
"lf em 4x70 write -b 15 d c0de -> write 'c0de' to block 15\n"
|
||||
"lf em 4x70 write -p -b 15 -d c0de -> adds parity bit to commands\n"
|
||||
);
|
||||
"lf em 4x70 write -b 15 -d c0de -> write 'c0de' to block 15\n"
|
||||
"lf em 4x70 write -b 15 -d c0de --par -> adds parity bit to commands\n"
|
||||
);
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_lit0("p", "parity", "Add parity bit when sending commands"),
|
||||
arg_int1("b", "block", "<dec>", "block/word address, dec"),
|
||||
arg_str1("d", "data", "<hex>", "data, 2 bytes"),
|
||||
arg_lit0(NULL, "par", "Add parity bit when sending commands"),
|
||||
arg_int1("b", "block", "<dec>", "block/word address, dec"),
|
||||
arg_str1("d", "data", "<hex>", "data, 2 bytes"),
|
||||
arg_param_end
|
||||
};
|
||||
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
|
||||
|
||||
etd.parity = arg_get_lit(ctx, 1);
|
||||
|
||||
|
||||
int addr = arg_get_int(ctx, 2);
|
||||
|
||||
|
||||
int word_len = 0;
|
||||
uint8_t word[2] = {0x0};
|
||||
CLIGetHexWithReturn(ctx, 3, word, &word_len);
|
||||
@@ -153,8 +153,8 @@ int CmdEM4x70Write(const char *Cmd) {
|
||||
if (addr < 0 || addr >= EM4X70_NUM_BLOCKS) {
|
||||
PrintAndLogEx(FAILED, "block has to be within range [0, 15]");
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
if (word_len != 2) {
|
||||
PrintAndLogEx(FAILED, "word/data length must be 2 bytes instead of %d", word_len);
|
||||
return PM3_EINVARG;
|
||||
@@ -181,10 +181,135 @@ int CmdEM4x70Write(const char *Cmd) {
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
int CmdEM4x70Unlock(const char *Cmd) {
|
||||
|
||||
// send pin code to device, unlocking it for writing
|
||||
em4x70_data_t etd = {0};
|
||||
|
||||
CLIParserContext *ctx;
|
||||
|
||||
CLIParserInit(&ctx, "lf em 4x70 unlock",
|
||||
"Unlock EM4x70 by sending PIN\n"
|
||||
"Default pin may be:\n"
|
||||
" AAAAAAAA\n"
|
||||
" 00000000\n",
|
||||
"lf em 4x70 unlock -p 11223344 -> Unlock with PIN\n"
|
||||
"lf em 4x70 unlock -p 11223344 --par -> Unlock with PIN using parity commands\n"
|
||||
);
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_lit0(NULL, "par", "Add parity bit when sending commands"),
|
||||
arg_str1("p", "pin", "<hex>", "pin, 4 bytes"),
|
||||
arg_param_end
|
||||
};
|
||||
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
|
||||
etd.parity = arg_get_lit(ctx, 1);
|
||||
|
||||
int pin_len = 0;
|
||||
uint8_t pin[4] = {0x0};
|
||||
|
||||
CLIGetHexWithReturn(ctx, 2, pin, &pin_len);
|
||||
|
||||
CLIParserFree(ctx);
|
||||
|
||||
if (pin_len != 4) {
|
||||
PrintAndLogEx(FAILED, "PIN length must be 4 bytes instead of %d", pin_len);
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
etd.pin = BYTES2UINT32(pin);
|
||||
|
||||
clearCommandBuffer();
|
||||
SendCommandNG(CMD_LF_EM4X70_UNLOCK, (uint8_t *)&etd, sizeof(etd));
|
||||
|
||||
PacketResponseNG resp;
|
||||
if (!WaitForResponseTimeout(CMD_LF_EM4X70_UNLOCK, &resp, TIMEOUT)) {
|
||||
PrintAndLogEx(WARNING, "Timeout while waiting for reply.");
|
||||
return PM3_ETIMEOUT;
|
||||
}
|
||||
|
||||
if (resp.status) {
|
||||
print_info_result(resp.data.asBytes);
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
PrintAndLogEx(FAILED, "Unlocking tag " _RED_("failed"));
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
int CmdEM4x70Auth(const char *Cmd) {
|
||||
|
||||
// Authenticate transponder
|
||||
// Send 56-bit random number + pre-computed f(rnd, k) to transponder.
|
||||
// Transponder will respond with a response
|
||||
em4x70_data_t etd = {0};
|
||||
|
||||
CLIParserContext *ctx;
|
||||
|
||||
CLIParserInit(&ctx, "lf em 4x70 auth",
|
||||
"Authenticate against an EM4x70 by sending random number (RN) and F(RN)\n"
|
||||
" If F(RN) is incorrect based on the tag crypt key, the tag will not respond",
|
||||
"lf em 4x70 auth --rnd 11223344556677 --frn 11223344\n"
|
||||
);
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_lit0(NULL, "par", "Add parity bit when sending commands"),
|
||||
arg_str1(NULL, "rnd", "<hex>", "Random 56-bit"),
|
||||
arg_str1(NULL, "frn", "<hex>", "F(RN) 28-bit as 4 hex bytes"),
|
||||
arg_param_end
|
||||
};
|
||||
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
|
||||
etd.parity = arg_get_lit(ctx, 1);
|
||||
|
||||
int rnd_len = 7;
|
||||
CLIGetHexWithReturn(ctx, 2, etd.rnd, &rnd_len);
|
||||
|
||||
int frnd_len = 4;
|
||||
CLIGetHexWithReturn(ctx, 3, etd.frnd, &frnd_len);
|
||||
|
||||
CLIParserFree(ctx);
|
||||
|
||||
if (rnd_len != 7) {
|
||||
PrintAndLogEx(FAILED, "Random number length must be 7 bytes instead of %d", rnd_len);
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
if (frnd_len != 4) {
|
||||
PrintAndLogEx(FAILED, "F(RN) length must be 4 bytes instead of %d", frnd_len);
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
clearCommandBuffer();
|
||||
SendCommandNG(CMD_LF_EM4X70_AUTH, (uint8_t *)&etd, sizeof(etd));
|
||||
|
||||
PacketResponseNG resp;
|
||||
if (!WaitForResponseTimeout(CMD_LF_EM4X70_AUTH, &resp, TIMEOUT)) {
|
||||
PrintAndLogEx(WARNING, "Timeout while waiting for reply.");
|
||||
return PM3_ETIMEOUT;
|
||||
}
|
||||
|
||||
if (resp.status) {
|
||||
// Response is 20-bit from tag
|
||||
PrintAndLogEx(INFO, "Tag Auth Response: %02X %02X %02X", resp.data.asBytes[2], resp.data.asBytes[1], resp.data.asBytes[0]);
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
PrintAndLogEx(FAILED, "TAG Authentication " _RED_("Failed"));
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
static command_t CommandTable[] = {
|
||||
{"help", CmdHelp, AlwaysAvailable, "This help"},
|
||||
{"info", CmdEM4x70Info, IfPm3EM4x70, "Tag information EM4x70"},
|
||||
{"write", CmdEM4x70Write, IfPm3EM4x70, "Write EM4x70"},
|
||||
{"unlock", CmdEM4x70Unlock, IfPm3EM4x70, "Unlock EM4x70 for writing"},
|
||||
{"auth", CmdEM4x70Auth, IfPm3EM4x70, "Authenticate EM4x70"},
|
||||
{NULL, NULL, NULL, NULL}
|
||||
};
|
||||
|
||||
|
||||
@@ -19,6 +19,8 @@
|
||||
int CmdLFEM4X70(const char *Cmd);
|
||||
int CmdEM4x70Info(const char *Cmd);
|
||||
int CmdEM4x70Write(const char *Cmd);
|
||||
int CmdEM4x70Unlock(const char *Cmd);
|
||||
int CmdEM4x70Auth(const char *Cmd);
|
||||
|
||||
int em4x70_info(void);
|
||||
bool detect_4x70_block(void);
|
||||
|
||||
@@ -727,7 +727,7 @@ static int CmdFdxBClone(const char *Cmd) {
|
||||
}
|
||||
|
||||
uint32_t extended = 0;
|
||||
bool has_extended = false;
|
||||
bool has_extended = false;
|
||||
if (extended_len) {
|
||||
extended = bytes_to_num(edata, extended_len);
|
||||
has_extended = true;
|
||||
@@ -773,10 +773,10 @@ static int CmdFdxBClone(const char *Cmd) {
|
||||
free(bs);
|
||||
|
||||
PrintAndLogEx(INFO, "Preparing to clone FDX-B to " _YELLOW_("%s") " with animal ID: " _GREEN_("%04u-%"PRIu64)
|
||||
, cardtype
|
||||
, country_code
|
||||
, national_code
|
||||
);
|
||||
, cardtype
|
||||
, country_code
|
||||
, national_code
|
||||
);
|
||||
print_blocks(blocks, ARRAYLEN(blocks));
|
||||
|
||||
int res;
|
||||
@@ -820,7 +820,7 @@ static int CmdFdxBSim(const char *Cmd) {
|
||||
CLIParserFree(ctx);
|
||||
|
||||
uint32_t extended = 0;
|
||||
bool has_extended = false;
|
||||
bool has_extended = false;
|
||||
if (extended_len) {
|
||||
extended = bytes_to_num(edata, extended_len);
|
||||
has_extended = true;
|
||||
|
||||
@@ -233,7 +233,7 @@ static int CmdGallagherClone(const char *Cmd) {
|
||||
|
||||
static int CmdGallagherSim(const char *Cmd) {
|
||||
|
||||
CLIParserContext *ctx;
|
||||
CLIParserContext *ctx;
|
||||
CLIParserInit(&ctx, "lf gallagher sim",
|
||||
"Enables simulation of GALLAGHER card with specified card number.\n"
|
||||
"Simulation runs until the button is pressed or another USB command is issued.\n",
|
||||
|
||||
@@ -226,10 +226,10 @@ static int CmdGuardClone(const char *Cmd) {
|
||||
free(bs);
|
||||
|
||||
PrintAndLogEx(INFO, "Preparing to clone Guardall to " _YELLOW_("%s") " with Facility Code: " _GREEN_("%u") " Card Number: " _GREEN_("%u")
|
||||
, cardtype
|
||||
, facilitycode
|
||||
, cardnumber
|
||||
);
|
||||
, cardtype
|
||||
, facilitycode
|
||||
, cardnumber
|
||||
);
|
||||
print_blocks(blocks, ARRAYLEN(blocks));
|
||||
|
||||
int res;
|
||||
@@ -281,9 +281,9 @@ static int CmdGuardSim(const char *Cmd) {
|
||||
}
|
||||
|
||||
PrintAndLogEx(SUCCESS, "Simulating Guardall Prox - Facility Code: " _YELLOW_("%u") " CardNumber: " _YELLOW_("%u")
|
||||
, facilitycode
|
||||
, cardnumber
|
||||
);
|
||||
, facilitycode
|
||||
, cardnumber
|
||||
);
|
||||
|
||||
// Guard uses: clk: 64, invert: 0, encoding: 2 (ASK Biphase)
|
||||
lf_asksim_t *payload = calloc(1, sizeof(lf_asksim_t) + sizeof(bs));
|
||||
|
||||
@@ -60,16 +60,16 @@ static int sendTry(uint8_t format_idx, wiegand_card_t *card, uint32_t delay, boo
|
||||
|
||||
if (HIDPack(format_idx, card, &packed) == false) {
|
||||
PrintAndLogEx(WARNING, "The card data could not be encoded in the selected format.");
|
||||
return PM3_ESOFT;
|
||||
return PM3_ESOFT;
|
||||
}
|
||||
|
||||
if (verbose) {
|
||||
PrintAndLogEx(INFO, "Trying FC: " _YELLOW_("%u") " CN: " _YELLOW_("%"PRIu64) " Issue level: " _YELLOW_("%u") " OEM: " _YELLOW_("%u")
|
||||
, card->FacilityCode
|
||||
, card->CardNumber
|
||||
, card->IssueLevel
|
||||
, card->OEM
|
||||
);
|
||||
, card->FacilityCode
|
||||
, card->CardNumber
|
||||
, card->IssueLevel
|
||||
, card->OEM
|
||||
);
|
||||
}
|
||||
|
||||
lf_hidsim_t payload;
|
||||
|
||||
@@ -250,7 +250,7 @@ static int CmdIndalaDemod(const char *Cmd) {
|
||||
"lf indala demod --clock 32 -> demod a Indala tag from GraphBuffer using a clock of RF/32\n"
|
||||
"lf indala demod --clock 32 -i -> demod a Indala tag from GraphBuffer using a clock of RF/32 and inverting data\n"
|
||||
"lf indala demod --clock 64 -i --maxerror 0 -> demod a Indala tag from GraphBuffer using a clock of RF/64, inverting data and allowing 0 demod errors"
|
||||
);
|
||||
);
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
@@ -281,7 +281,7 @@ static int CmdIndalaDemodAlt(const char *Cmd) {
|
||||
"It's now considered obsolete but remains because it has sometimes its advantages.",
|
||||
"lf indala altdemod\n"
|
||||
"lf indala altdemod --long -> demod a Indala tag from GraphBuffer as 224 bit long format"
|
||||
);
|
||||
);
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
@@ -583,9 +583,9 @@ static int CmdIndalaSim(const char *Cmd) {
|
||||
// lf simpsk 1 c 32 r 2 d 0102030405060708
|
||||
|
||||
PrintAndLogEx(SUCCESS, "Simulating " _YELLOW_("%s") " Indala raw " _YELLOW_("%s")
|
||||
, (is_long_uid) ? "224b" : "64b"
|
||||
, sprint_hex_inrow(raw, raw_len)
|
||||
);
|
||||
, (is_long_uid) ? "224b" : "64b"
|
||||
, sprint_hex_inrow(raw, raw_len)
|
||||
);
|
||||
PrintAndLogEx(SUCCESS, "Press pm3-button to abort simulation or run another command");
|
||||
|
||||
// indala PSK, clock 32, carrier 0
|
||||
@@ -665,7 +665,7 @@ static int CmdIndalaClone(const char *Cmd) {
|
||||
uint8_t max = 0;
|
||||
uint32_t blocks[8] = {0};
|
||||
char cardtype[16] = {"T55x7"};
|
||||
|
||||
|
||||
if (is_long_uid) {
|
||||
|
||||
blocks[0] = T55x7_BITRATE_RF_32 | T55x7_MODULATION_PSK2 | (7 << T55x7_MAXBLOCK_SHIFT);
|
||||
@@ -673,7 +673,7 @@ static int CmdIndalaClone(const char *Cmd) {
|
||||
blocks[0] = T5555_FIXED | T5555_SET_BITRATE(32) | T5555_MODULATION_PSK2 | (7 << T5555_MAXBLOCK_SHIFT);
|
||||
snprintf(cardtype, sizeof(cardtype), "Q5/T5555");
|
||||
}
|
||||
|
||||
|
||||
if (em) {
|
||||
blocks[0] = EM4305_INDALA_224_CONFIG_BLOCK;
|
||||
snprintf(cardtype, sizeof(cardtype), "EM4305/4469");
|
||||
@@ -691,9 +691,9 @@ static int CmdIndalaClone(const char *Cmd) {
|
||||
// 224 BIT UID
|
||||
// config for Indala (RF/32;PSK2 with RF/2;Maxblock=7)
|
||||
PrintAndLogEx(INFO, "Preparing to clone Indala 224bit to " _YELLOW_("%s") " raw " _GREEN_("%s")
|
||||
, cardtype
|
||||
, sprint_hex_inrow(raw, raw_len)
|
||||
);
|
||||
, cardtype
|
||||
, sprint_hex_inrow(raw, raw_len)
|
||||
);
|
||||
|
||||
|
||||
} else {
|
||||
@@ -737,7 +737,7 @@ static int CmdIndalaClone(const char *Cmd) {
|
||||
blocks[0] = T5555_FIXED | T5555_SET_BITRATE(32) | T5555_MODULATION_PSK1 | (2 << T5555_MAXBLOCK_SHIFT);
|
||||
snprintf(cardtype, sizeof(cardtype), "Q5/T5555");
|
||||
}
|
||||
|
||||
|
||||
if (em) {
|
||||
blocks[0] = EM4305_INDALA_64_CONFIG_BLOCK;
|
||||
snprintf(cardtype, sizeof(cardtype), "EM4305/4469");
|
||||
@@ -749,9 +749,9 @@ static int CmdIndalaClone(const char *Cmd) {
|
||||
|
||||
// config for Indala 64 format (RF/32;PSK1 with RF/2;Maxblock=2)
|
||||
PrintAndLogEx(INFO, "Preparing to clone Indala 64bit to " _YELLOW_("%s") " raw " _GREEN_("%s")
|
||||
, cardtype
|
||||
, sprint_hex_inrow(raw, raw_len)
|
||||
);
|
||||
, cardtype
|
||||
, sprint_hex_inrow(raw, raw_len)
|
||||
);
|
||||
}
|
||||
|
||||
print_blocks(blocks, max);
|
||||
|
||||
@@ -318,12 +318,12 @@ static int CmdIOProxClone(const char *Cmd) {
|
||||
blocks[2] = bytebits_to_byte(bits + 32, 32);
|
||||
|
||||
PrintAndLogEx(INFO, "Preparing to clone ioProx to " _YELLOW_("%s") " with Version: " _GREEN_("%u") " FC: " _GREEN_("%u (0x%02x)") " CN: " _GREEN_("%u")
|
||||
, cardtype
|
||||
, version
|
||||
, fc
|
||||
, fc
|
||||
, cn
|
||||
);
|
||||
, cardtype
|
||||
, version
|
||||
, fc
|
||||
, fc
|
||||
, cn
|
||||
);
|
||||
print_blocks(blocks, ARRAYLEN(blocks));
|
||||
|
||||
int res;
|
||||
|
||||
@@ -219,11 +219,11 @@ static int CmdJablotronClone(const char *Cmd) {
|
||||
|
||||
free(bits);
|
||||
|
||||
uint64_t id = getJablontronCardId(fullcode);
|
||||
uint64_t id = getJablontronCardId(fullcode);
|
||||
|
||||
PrintAndLogEx(INFO, "Preparing to clone Jablotron to " _YELLOW_("%s") " with FullCode: " _GREEN_("%"PRIx64)" id: " _GREEN_("%"PRIx64), cardtype, fullcode, id);
|
||||
print_blocks(blocks, ARRAYLEN(blocks));
|
||||
|
||||
|
||||
int res;
|
||||
if (em) {
|
||||
res = em4x05_clone_tag(blocks, ARRAYLEN(blocks), 0, false);
|
||||
|
||||
@@ -264,7 +264,7 @@ static int CmdMotorolaSim(const char *Cmd) {
|
||||
};
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
CLIParserFree(ctx);
|
||||
|
||||
|
||||
// PSK sim.
|
||||
PrintAndLogEx(INFO, " PSK1 at 66 kHz... Interesting.");
|
||||
PrintAndLogEx(INFO, " To be implemented, feel free to contribute!");
|
||||
|
||||
@@ -145,13 +145,13 @@ int demodNedap(bool verbose) {
|
||||
badgeId = r1 * 10000 + r2 * 1000 + r3 * 100 + r4 * 10 + r5;
|
||||
|
||||
PrintAndLogEx(SUCCESS, "NEDAP (%s) - ID: " _YELLOW_("%05u") " subtype: " _YELLOW_("%1u")" customer code: " _YELLOW_("%u / 0x%03X") " Raw: " _YELLOW_("%s")
|
||||
, (size == 128) ? "128b" : "64b"
|
||||
, badgeId
|
||||
, subtype
|
||||
, customerCode
|
||||
, customerCode
|
||||
, sprint_hex_inrow(data, size / 8)
|
||||
);
|
||||
, (size == 128) ? "128b" : "64b"
|
||||
, badgeId
|
||||
, subtype
|
||||
, customerCode
|
||||
, customerCode
|
||||
, sprint_hex_inrow(data, size / 8)
|
||||
);
|
||||
PrintAndLogEx(DEBUG, "Checksum (%s) 0x%04X", _GREEN_("ok"), checksum);
|
||||
|
||||
} else {
|
||||
@@ -373,7 +373,7 @@ static int CmdLFNedapClone(const char *Cmd) {
|
||||
arg_u64_0(NULL, "st", "<dec>", "optional - sub type (default 5)"),
|
||||
arg_u64_1(NULL, "cc", "<dec>", "customer code (0-4095)"),
|
||||
arg_u64_1(NULL, "id", "<dec>", "ID (0-99999)"),
|
||||
arg_lit0("l", "long", "optional - long (128), default to short (64)"),
|
||||
arg_lit0("l", "long", "optional - long (128), default to short (64)"),
|
||||
arg_lit0(NULL, "q5", "optional - specify writing to Q5/T5555 tag"),
|
||||
arg_lit0(NULL, "em", "optional - specify writing to EM4305/4469 tag"),
|
||||
arg_param_end
|
||||
@@ -395,17 +395,17 @@ static int CmdLFNedapClone(const char *Cmd) {
|
||||
}
|
||||
if (sub_type > 0xF) {
|
||||
PrintAndLogEx(FAILED, "out-of-range, valid subtype is between 0-15");
|
||||
return PM3_EINVARG;
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
if (customer_code > 0xFFF) {
|
||||
PrintAndLogEx(FAILED, "out-of-range, valid customer code is between 0-4095");
|
||||
return PM3_EINVARG;
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
if (id > 99999) {
|
||||
PrintAndLogEx(FAILED, "out-of-range, id max value is 99999");
|
||||
return PM3_EINVARG;
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
PrintAndLogEx(SUCCESS, "NEDAP (%s) - ID: " _GREEN_("%05u") " subtype: " _GREEN_("%1u") " customer code: " _GREEN_("%u / 0x%03X")
|
||||
@@ -454,7 +454,7 @@ static int CmdLFNedapClone(const char *Cmd) {
|
||||
NedapGen(sub_type, customer_code, id, is_long, data);
|
||||
|
||||
for (uint8_t i = 1; i < max ; i++) {
|
||||
blocks[i] = bytes_to_num (data + ((i - 1) * 4), 4);
|
||||
blocks[i] = bytes_to_num(data + ((i - 1) * 4), 4);
|
||||
}
|
||||
|
||||
PrintAndLogEx(SUCCESS, "Preparing to clone NEDAP to " _YELLOW_("%s") " tag", cardtype);
|
||||
@@ -492,7 +492,7 @@ static int CmdLFNedapSim(const char *Cmd) {
|
||||
arg_u64_0(NULL, "st", "<dec>", "optional - sub type (default 5)"),
|
||||
arg_u64_1(NULL, "cc", "<dec>", "customer code (0-4095)"),
|
||||
arg_u64_1(NULL, "id", "<dec>", "ID (0-99999)"),
|
||||
arg_lit0("l", "long", "optional - long (128), default to short (64)"),
|
||||
arg_lit0("l", "long", "optional - long (128), default to short (64)"),
|
||||
arg_param_end
|
||||
};
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
||||
@@ -502,20 +502,20 @@ static int CmdLFNedapSim(const char *Cmd) {
|
||||
uint32_t id = arg_get_u32_def(ctx, 3, 0);
|
||||
bool is_long = arg_get_lit(ctx, 4);
|
||||
CLIParserFree(ctx);
|
||||
|
||||
|
||||
if (sub_type > 0xF) {
|
||||
PrintAndLogEx(FAILED, "out-of-range, valid subtype is between 0-15");
|
||||
return PM3_EINVARG;
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
if (customer_code > 0xFFF) {
|
||||
PrintAndLogEx(FAILED, "out-of-range, valid customer code is between 0-4095");
|
||||
return PM3_EINVARG;
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
if (id > 99999) {
|
||||
PrintAndLogEx(FAILED, "out-of-range, id max value is 99999");
|
||||
return PM3_EINVARG;
|
||||
return PM3_EINVARG;
|
||||
}
|
||||
|
||||
PrintAndLogEx(SUCCESS, "NEDAP (%s) - ID: " _GREEN_("%05u") " subtype: " _GREEN_("%1u") " customer code: " _GREEN_("%u / 0x%03X")
|
||||
|
||||
@@ -125,7 +125,7 @@ static int CmdLFPCF7931Config(const char *Cmd) {
|
||||
}
|
||||
|
||||
if (pwd_len) {
|
||||
memcpy(configPcf.Pwd, pwd, sizeof(configPcf.Pwd));
|
||||
memcpy(configPcf.Pwd, pwd, sizeof(configPcf.Pwd));
|
||||
}
|
||||
if (delay != -1) {
|
||||
configPcf.InitDelay = (delay & 0xFFFF);
|
||||
@@ -134,7 +134,7 @@ static int CmdLFPCF7931Config(const char *Cmd) {
|
||||
configPcf.OffsetWidth = (ow & 0xFFFF);
|
||||
}
|
||||
if (op != 0xFFFF) {
|
||||
configPcf.OffsetPosition =(op & 0xFFFF);
|
||||
configPcf.OffsetPosition = (op & 0xFFFF);
|
||||
}
|
||||
|
||||
pcf7931_printConfig();
|
||||
|
||||
@@ -2806,7 +2806,7 @@ char *GetModelStrFromCID(uint32_t cid) {
|
||||
}
|
||||
|
||||
char *GetConfigBlock0Source(uint8_t id) {
|
||||
|
||||
|
||||
static char buf[40];
|
||||
char *retStr = buf;
|
||||
|
||||
|
||||
@@ -129,7 +129,7 @@ typedef struct {
|
||||
notSet = 0x00,
|
||||
autoDetect = 0x01,
|
||||
userSet = 0x02,
|
||||
tagRead = 0x03,
|
||||
tagRead = 0x03,
|
||||
} block0Status;
|
||||
enum {
|
||||
RF_8 = 0x00,
|
||||
|
||||
@@ -330,7 +330,7 @@ static int CmdTIWrite(const char *Cmd) {
|
||||
arg_param_begin,
|
||||
arg_str1("r", "raw", "<hex>", "raw hex data. 8 bytes max"),
|
||||
arg_str0(NULL, "crc", "<hex>", "optional - crc"),
|
||||
arg_param_end
|
||||
arg_param_end
|
||||
};
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
||||
|
||||
@@ -354,7 +354,7 @@ static int CmdTIWrite(const char *Cmd) {
|
||||
payload.crc = bytes_to_num(crc, crc_len);
|
||||
|
||||
clearCommandBuffer();
|
||||
SendCommandNG(CMD_LF_TI_WRITE, (uint8_t*)&payload, sizeof(payload));
|
||||
SendCommandNG(CMD_LF_TI_WRITE, (uint8_t *)&payload, sizeof(payload));
|
||||
PrintAndLogEx(SUCCESS, "Done");
|
||||
PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf ti reader`") " to verify");
|
||||
return PM3_SUCCESS;
|
||||
|
||||
Reference in New Issue
Block a user