diff --git a/armsrc/appmain.c b/armsrc/appmain.c index 222e4b219..549feff0b 100644 --- a/armsrc/appmain.c +++ b/armsrc/appmain.c @@ -1064,6 +1064,10 @@ void UsbPacketReceived(uint8_t *packet, int len) case CMD_READER_LEGIC_RF: LegicRfReader(c->arg[0], c->arg[1], c->arg[2]); break; + + case CMD_LEGIC_INFO: + LegicRfInfo(); + break; #endif #ifdef WITH_ISO14443b diff --git a/armsrc/legicrf.c b/armsrc/legicrf.c index 5b0cccf0c..7a156f69f 100644 --- a/armsrc/legicrf.c +++ b/armsrc/legicrf.c @@ -246,8 +246,8 @@ void frame_sendAsReader(uint32_t data, uint8_t bits){ bits, BYTEx(data, 0), BYTEx(data, 1), - 0x00, - 0x00, + BYTEx(send, 0), + BYTEx(send, 1), prngstart, legic_prng_count() }; @@ -304,12 +304,14 @@ static void frame_receiveAsReader(struct legic_frame * const f, uint8_t bits) { // 500 = 0x1C 0001 1100 uint32_t starttime = GET_TICKS; //uint16_t mywait = TAG_FRAME_WAIT - (starttime - sendFrameStop); - uint16_t mywait = 495 - (starttime - sendFrameStop); - if ( bits == 6) - WaitTicks( 495 - 9 ); - else { - //Dbprintf("WAIT %d", mywait ); - WaitTicks( mywait ); + //uint16_t mywait = 495 - (starttime - sendFrameStop); + if ( bits == 6) { + //Dbprintf("6 WAIT %d", 495 - 9 - 9 ); + WaitTicks( 495 - 9 - 9 ); + } else { + //Dbprintf("x WAIT %d", mywait ); + //WaitTicks( mywait ); + WaitTicks( 450 ); } next_bit_at = GET_TICKS + TAG_BIT_PERIOD; @@ -419,9 +421,9 @@ static void LegicCommonInit(void) { // Switch off carrier, make sure tag is reset static void switch_off_tag_rwd(void) { LOW(GPIO_SSC_DOUT); - WaitUS(200); + WaitUS(20); WDT_HIT(); - Dbprintf("Exit Switch_off_tag_rwd"); + set_tracing(FALSE); } // calculate crc4 for a legic READ command @@ -438,6 +440,9 @@ static uint32_t legic4Crc(uint8_t legicCmd, uint16_t byte_index, uint8_t value, int legic_read_byte(int byte_index, int cmd_sz) { + uint8_t byte = 0, crc = 0, calcCrc = 0; + uint32_t cmd = (byte_index << 1) | LEGIC_READ; + // (us)| ticks // ------------- // 330 | 495 @@ -446,10 +451,7 @@ int legic_read_byte(int byte_index, int cmd_sz) { // 244 | 366 WaitTicks(387); legic_prng_forward(4); // 460 / 100 = 4.6 iterations - - uint8_t byte = 0, crc = 0, calcCrc = 0; - uint32_t cmd = (byte_index << 1) | LEGIC_READ; - + frame_sendAsReader(cmd, cmd_sz); frame_receiveAsReader(¤t_frame, 12); @@ -776,6 +778,49 @@ void LegicRfRawWriter(int address, int byte, int iv) { if ( MF_DBGLEVEL >= 1) DbpString("write successful"); } +void LegicRfInfo(void){ + + LegicCommonInit(); + uint32_t tag_type = setup_phase_reader(0x55); + uint8_t cmd_sz = 0; + uint16_t card_sz = 0; + + switch(tag_type) { + case 0x0d: + cmd_sz = 6; + card_sz = 22; + break; + case 0x1d: + cmd_sz = 9; + card_sz = 256; + break; + case 0x3d: + cmd_sz = 11; + card_sz = 1024; + break; + default: + cmd_send(CMD_ACK,0,0,0,0,0); + goto OUT; + } + + // read UID bytes. + uint8_t uid[] = {0,0,0,0}; + for ( uint8_t i = 0; i < sizeof(uid); ++i) { + int r = legic_read_byte(i, cmd_sz); + if ( r == -1 ) { + cmd_send(CMD_ACK,0,0,0,0,0); + goto OUT; + } + uid[i] = r & 0xFF; + } + + cmd_send(CMD_ACK,1,card_sz,0,uid,sizeof(uid)); +out: + switch_off_tag_rwd(); + LEDsoff(); + +} + /* Handle (whether to respond) a frame in tag mode * Only called when simulating a tag. */ @@ -1656,56 +1701,6 @@ static void CodeAndTransmitLegicAsReader(const uint8_t *cmd, uint8_t cmdlen, int } } -int ice_legic_select_card() -{ - //int cmd_size=0, card_size=0; - uint8_t wakeup[] = { 0x7F }; - uint8_t getid[] = {0x19}; - - //legic_prng_init(SESSION_IV); - - // first, wake up the tag, 7bits - CodeAndTransmitLegicAsReader(wakeup, sizeof(wakeup), 7); - - GetSamplesForLegicDemod(1000, TRUE); - - //frame_receiveAsReader(¤t_frame, 6, 1); - - legic_prng_forward(1); /* we wait anyways */ - - //while(timer->TC_CV < 387) ; /* ~ 258us */ - //frame_sendAsReader(0x19, 6); - CodeAndTransmitLegicAsReader(getid, sizeof(getid), 8); - GetSamplesForLegicDemod(1000, TRUE); - - //if (Demod.len < 14) return 2; - Dbprintf("CARD TYPE: %02x LEN: %d", Demod.output[0], Demod.len); - - switch(Demod.output[0]) { - case 0x1d: - DbpString("MIM 256 card found"); - // cmd_size = 9; - // card_size = 256; - break; - case 0x3d: - DbpString("MIM 1024 card found"); - // cmd_size = 11; - // card_size = 1024; - break; - default: - return -1; - } - - // if(bytes == -1) - // bytes = card_size; - - // if(bytes + offset >= card_size) - // bytes = card_size - offset; - - FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); - set_tracing(FALSE); - return 1; -} // Set up LEGIC communication void ice_legic_setup() { diff --git a/armsrc/legicrf.h b/armsrc/legicrf.h index 2008f5b97..992878421 100644 --- a/armsrc/legicrf.h +++ b/armsrc/legicrf.h @@ -19,13 +19,11 @@ #include "crc.h" // legic crc-4 #include "ticks.h" // timers -#define LEGIC_READ 0x01 -#define LEGIC_WRITE 0x00 - extern void LegicRfSimulate(int phase, int frame, int reqresp); extern int LegicRfReader(int offset, int bytes, int iv); extern void LegicRfWriter(int offset, int bytes, int iv); extern void LegicRfRawWriter(int address, int data, int iv); +extern void LegicRfInfo(void); uint32_t get_key_stream(int skip, int count); void frame_send_tag(uint16_t response, uint8_t bits, uint8_t crypt); diff --git a/client/cmdhf.c b/client/cmdhf.c index 6701bee1e..b24087827 100644 --- a/client/cmdhf.c +++ b/client/cmdhf.c @@ -894,6 +894,12 @@ int CmdHFSearch(const char *Cmd){ PrintAndLog("\nValid Topaz Tag Found - Quiting Search\n"); return 1; } + ans = HFLegicInfo("", false); + if ( ans == 0) { + PrintAndLog("\nValid LEGIC Tag Found - Quiting Search\n"); + return 1; + } + PrintAndLog("\nno known/supported 13.56 MHz tags found\n"); return 0; } diff --git a/client/cmdhflegic.c b/client/cmdhflegic.c index 51082aa09..2200a15b9 100644 --- a/client/cmdhflegic.c +++ b/client/cmdhflegic.c @@ -90,7 +90,16 @@ int usage_legic_fill(void){ PrintAndLog("Missing help text."); return 0; } - +int usage_legic_info(void){ + PrintAndLog("Read info from a legic tag."); + PrintAndLog("Usage: hf legic info [h]"); + PrintAndLog("Options:"); + PrintAndLog(" h : this help"); + PrintAndLog(""); + PrintAndLog("Samples:"); + PrintAndLog(" hf legic info"); + return 0; +} /* * Output BigBuf and deobfuscate LEGIC RF tag data. * This is based on information given in the talk held @@ -810,6 +819,43 @@ int CmdLegicCalcCrc8(const char *Cmd){ return 0; } +int HFLegicInfo(const char *Cmd, bool verbose) { + + char cmdp = param_getchar(Cmd, 0); + if ( cmdp == 'H' || cmdp == 'h' ) return usage_legic_info(); + + UsbCommand c = {CMD_LEGIC_INFO, {0,0,0}}; + clearCommandBuffer(); + SendCommand(&c); + UsbCommand resp; + if (WaitForResponseTimeout(CMD_ACK, &resp, 1000)) { + uint8_t isOK = resp.arg[0] & 0xFF; + uint16_t tagtype = resp.arg[1] & 0xFFF; + if ( isOK ) { + PrintAndLog(" UID : %s", sprint_hex(resp.d.asBytes, 4)); + switch(tagtype) { + case 22: PrintAndLog("MIM22 card (22bytes)"); break; + case 256: PrintAndLog("MIM256 card (256bytes)"); break; + case 1024: PrintAndLog("MIM1024 card (1024bytes)"); break; + default: { + PrintAndLog("Unknown card format: %x", tagtype); + return 1; + } + } + } else { + PrintAndLog("legic card select failed"); + return 1; + } + } else { + PrintAndLog("command execution time out"); + return 1; + } + return 0; +} +int CmdLegicInfo(const char *Cmd){ + return HFLegicInfo(Cmd, TRUE); +} + static command_t CommandTable[] = { {"help", CmdHelp, 1, "This help"}, {"decode", CmdLegicDecode, 0, "Display deobfuscated and decoded LEGIC RF tag data (use after hf legic reader)"}, @@ -821,7 +867,7 @@ static command_t CommandTable[] = { {"writeraw",CmdLegicRfRawWrite, 0, "
-- Write direct to address"}, {"fill", CmdLegicRfFill, 0, " -- Fill/Write tag with constant value"}, {"crc8", CmdLegicCalcCrc8, 1, "Calculate Legic CRC8 over given hexbytes"}, - {"info", CmdLegicCalcCrc8, 1, "Information"}, + {"info", CmdLegicInfo, 1, "Information"}, {NULL, NULL, 0, NULL} }; diff --git a/client/cmdhflegic.h b/client/cmdhflegic.h index 60818f616..b43c47fe6 100644 --- a/client/cmdhflegic.h +++ b/client/cmdhflegic.h @@ -34,8 +34,11 @@ int CmdLegicRfRawWrite(const char *Cmd); int CmdLegicRfFill(const char *Cmd); int CmdLegicCalcCrc8(const char *Cmd); +int CmdLegicInfo(const char *Cmd); +int HFLegicInfo(const char *Cmd, bool verbose); int usage_legic_calccrc8(void); int usage_legic_load(void); int usage_legic_read(void); +int usage_legic_info(void); #endif diff --git a/client/hid-flasher/usb_cmd.h b/client/hid-flasher/usb_cmd.h index f1f3eb94f..1c61ebcfb 100644 --- a/client/hid-flasher/usb_cmd.h +++ b/client/hid-flasher/usb_cmd.h @@ -129,12 +129,16 @@ typedef struct { #define CMD_SNOOP_ISO_14443a 0x0383 #define CMD_SIMULATE_TAG_ISO_14443a 0x0384 #define CMD_READER_ISO_14443a 0x0385 + #define CMD_SIMULATE_TAG_LEGIC_RF 0x0387 #define CMD_READER_LEGIC_RF 0x0388 #define CMD_WRITER_LEGIC_RF 0x0389 + #define CMD_EPA_PACE_COLLECT_NONCE 0x038A #define CMD_EPA_PACE_REPLAY 0x038B +#define CMD_LEGIC_INFO 0x03BC + #define CMD_SNOOP_ICLASS 0x0392 #define CMD_SIMULATE_TAG_ICLASS 0x0393 #define CMD_READER_ICLASS 0x0394 diff --git a/client/lualibs/commands.lua b/client/lualibs/commands.lua index b953562e8..680e6da91 100644 --- a/client/lualibs/commands.lua +++ b/client/lualibs/commands.lua @@ -99,9 +99,12 @@ local _commands = { CMD_SIMULATE_TAG_LEGIC_RF = 0x0387, CMD_READER_LEGIC_RF = 0x0388, CMD_WRITER_LEGIC_RF = 0x0389, + CMD_EPA_PACE_COLLECT_NONCE = 0x038A, CMD_EPA_PACE_REPLAY = 0x038B, + CMD_LEGIC_INFO = 0x03BC, + CMD_ICLASS_READCHECK = 0x038F, CMD_ICLASS_CLONE = 0x0390, CMD_ICLASS_DUMP = 0x0391, diff --git a/include/usb_cmd.h b/include/usb_cmd.h index e4ec04935..a0ce42236 100644 --- a/include/usb_cmd.h +++ b/include/usb_cmd.h @@ -142,9 +142,12 @@ typedef struct{ #define CMD_SIMULATE_TAG_LEGIC_RF 0x0387 #define CMD_READER_LEGIC_RF 0x0388 #define CMD_WRITER_LEGIC_RF 0x0389 + #define CMD_EPA_PACE_COLLECT_NONCE 0x038A #define CMD_EPA_PACE_REPLAY 0x038B +#define CMD_LEGIC_INFO 0x03BC + #define CMD_ICLASS_READCHECK 0x038F #define CMD_ICLASS_CLONE 0x0390 #define CMD_ICLASS_DUMP 0x0391