mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2025-02-25 00:25:48 +08:00
Iceman
GitHub
commit
a408abae3b
6 changed files with 53 additions and 373 deletions
|
|
@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file.
|
|||
This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
|
||||
|
||||
## [unreleased][unreleased]
|
||||
- Added `lf em 4x50 eview` - show uploaded EM4x50 data in emul memory (@tharexde)
|
||||
- Fix `data rawdemod` parsing for psk2 and user defined clock (@cyberpunk-re)
|
||||
- Added `hf iclass encode` - encode a wiegand binary to a encrypted credential (@iceman1001)
|
||||
- Changed `recoverpk.py` - now tests more ECDSA curves (@doegox)
|
||||
|
|
|
|||
|
|
@ -1,359 +0,0 @@
|
|||
//-----------------------------------------------------------------------------
|
||||
// Tharexde, 2020
|
||||
//
|
||||
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
|
||||
// at your option, any later version. See the LICENSE.txt file for the text of
|
||||
// the license.
|
||||
//-----------------------------------------------------------------------------
|
||||
// main code for EM4x50 simulator and collector aka THAREXDE
|
||||
//-----------------------------------------------------------------------------
|
||||
#include <inttypes.h>
|
||||
#include "standalone.h"
|
||||
#include "proxmark3_arm.h"
|
||||
#include "appmain.h"
|
||||
#include "BigBuf.h"
|
||||
#include "fpgaloader.h"
|
||||
#include "util.h"
|
||||
#include "dbprint.h"
|
||||
#include "spiffs.h"
|
||||
#include "../em4x50.h"
|
||||
|
||||
/*
|
||||
* `lf_tharexde` simulates hardcoded words/blocks, reads words of standard read
|
||||
* mode of EM4x50 tags and stores them in internal flash.
|
||||
* It requires RDV4 hardware (for flash and battery).
|
||||
*
|
||||
* On entering stand-alone mode, this module will start reading/record EM4x50 data.
|
||||
* Every found / collected data will be written/appended to the logfile in flash
|
||||
* as a text string.
|
||||
*
|
||||
* LEDs:
|
||||
* - LED A: simulating
|
||||
* - LED B: reading / record
|
||||
* - LED C: writing to flash
|
||||
* - LED D: unmounting/sync'ing flash (normally < 100ms)
|
||||
*
|
||||
* To retrieve log file from flash:
|
||||
*
|
||||
* 1. mem spiffs dump o lf_em4x50collect.log f lf_em4x50collect.log
|
||||
* Copies log file from flash to your client.
|
||||
*
|
||||
* 2. exit the Proxmark3 client
|
||||
*
|
||||
* 3. more lf_tharexdecollect.log
|
||||
*
|
||||
* This module emits debug strings during normal operation -- so try it out in
|
||||
* the lab connected to PM3 client before taking it into the field.
|
||||
*
|
||||
* To delete the log file from flash:
|
||||
*
|
||||
* 1. mem spiffs remove lf_tharexdecollect.log
|
||||
*/
|
||||
|
||||
#define STATE_SIM 0
|
||||
#define STATE_READ 1
|
||||
#define STATE_BRUTE 2
|
||||
#define EM4X50_TAG_WORD 45
|
||||
#define EM4X50_PWD_SPEED 27
|
||||
#define LF_EM4X50SIMULATE_INPUTFILE "lf_em4x50simulate.eml"
|
||||
#define LF_EM4X50COLLECT_LOGFILE "lf_em4x50collect.log"
|
||||
#define LF_EM4X50BRUTE_INPUTFILE "lf_em4x50brute.eml"
|
||||
#define LF_EM4X50BRUTE_LOGFILE "lf_em4x50brute.log"
|
||||
|
||||
bool input_exists;
|
||||
bool log_exists;
|
||||
|
||||
static void LoadDataInstructions(const char *inputfile) {
|
||||
Dbprintf("");
|
||||
Dbprintf("To load datafile into flash and display it:");
|
||||
Dbprintf(_YELLOW_("1.") " edit inputfile %s", inputfile);
|
||||
Dbprintf(_YELLOW_("2.") " start proxmark3 client");
|
||||
Dbprintf(_YELLOW_("3.") " mem spiffs load f %s o %s", inputfile, inputfile);
|
||||
Dbprintf(_YELLOW_("4.") " start standalone mode");
|
||||
}
|
||||
|
||||
static void DownloadLogInstructions(const char *logfile) {
|
||||
Dbprintf("");
|
||||
Dbprintf("To get the logfile from flash and display it:");
|
||||
Dbprintf(_YELLOW_("1.") " mem spiffs dump o %s f %s", logfile, logfile);
|
||||
Dbprintf(_YELLOW_("2.") " exit proxmark3 client");
|
||||
Dbprintf(_YELLOW_("3.") " cat %s", logfile);
|
||||
}
|
||||
|
||||
static int get_input_data_from_file(uint32_t *words, char *inputfile) {
|
||||
|
||||
size_t now = 0;
|
||||
|
||||
if (exists_in_spiffs(inputfile)) {
|
||||
|
||||
uint32_t size = size_in_spiffs(inputfile);
|
||||
uint8_t *mem = BigBuf_malloc(size);
|
||||
|
||||
Dbprintf(_YELLOW_("found input file %s"), inputfile);
|
||||
|
||||
rdv40_spiffs_read_as_filetype(inputfile, mem, size, RDV40_SPIFFS_SAFETY_SAFE);
|
||||
|
||||
now = size / 9;
|
||||
for (int i = 0; i < now; i++)
|
||||
for (int j = 0; j < 4; j++)
|
||||
words[i] |= (hex2int(mem[2 * j + 9 * i]) << 4 | hex2int(mem[2 * j + 1 + 9 * i])) << ((3 - j) * 8);
|
||||
|
||||
Dbprintf(_YELLOW_("read data from input file"));
|
||||
}
|
||||
|
||||
BigBuf_free();
|
||||
|
||||
return (now > 0) ? now : 0;
|
||||
}
|
||||
|
||||
static void append(const char *filename, uint8_t *entry, size_t entry_len) {
|
||||
|
||||
LED_D_ON();
|
||||
if (log_exists == false) {
|
||||
rdv40_spiffs_write(filename, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
|
||||
log_exists = true;
|
||||
} else {
|
||||
rdv40_spiffs_append(filename, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
|
||||
}
|
||||
LED_D_OFF();
|
||||
}
|
||||
|
||||
void ModInfo(void) {
|
||||
DbpString(_YELLOW_(" LF EM4x50 sim/collector/bruteforce mode") " - a.k.a tharexde");
|
||||
}
|
||||
|
||||
void RunMod(void) {
|
||||
|
||||
bool state_change = true;//, password_found = false;
|
||||
int pwd_found = false;
|
||||
uint8_t state = STATE_SIM;
|
||||
// declarations for simulating
|
||||
uint32_t words[33] = {0x0};
|
||||
uint32_t pwd = 0x0;
|
||||
uint32_t passwords[2] = {0x0};
|
||||
size_t now = 0;
|
||||
// declarations for reading
|
||||
int no_words = 0;
|
||||
//uint32_t words[EM4X50_TAG_WORD];
|
||||
uint8_t entry[81];
|
||||
|
||||
rdv40_spiffs_lazy_mount();
|
||||
|
||||
StandAloneMode();
|
||||
Dbprintf(_YELLOW_("Standalone mode THAREXDE started"));
|
||||
|
||||
for (;;) {
|
||||
|
||||
WDT_HIT();
|
||||
if (data_available()) break;
|
||||
|
||||
// press button - toggle between SIM, READ and BRUTE
|
||||
// hold button - exit
|
||||
int button_pressed = BUTTON_CLICKED(1000);
|
||||
if (button_pressed == BUTTON_SINGLE_CLICK) {
|
||||
|
||||
SpinUp(100);
|
||||
|
||||
switch (state) {
|
||||
|
||||
case STATE_SIM:
|
||||
state = STATE_READ;
|
||||
break;
|
||||
case STATE_READ:
|
||||
state = STATE_BRUTE;
|
||||
break;
|
||||
case STATE_BRUTE:
|
||||
state = STATE_SIM;
|
||||
break;
|
||||
default:
|
||||
break;
|
||||
}
|
||||
|
||||
state_change = true;
|
||||
|
||||
} else if (button_pressed == BUTTON_HOLD) {
|
||||
|
||||
SpinDown(100);
|
||||
break;
|
||||
}
|
||||
|
||||
if (state == STATE_SIM) {
|
||||
|
||||
if (state_change) {
|
||||
|
||||
FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT);
|
||||
FpgaSendCommand(FPGA_CMD_SET_DIVISOR, LF_DIVISOR_125);
|
||||
|
||||
AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT | GPIO_SSC_CLK;
|
||||
AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
|
||||
AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_CLK;
|
||||
|
||||
LEDsoff();
|
||||
LED_A_ON();
|
||||
Dbprintf("");
|
||||
Dbprintf(_YELLOW_("switched to EM4x50 simulating mode"));
|
||||
|
||||
now = get_input_data_from_file(words, LF_EM4X50SIMULATE_INPUTFILE);
|
||||
if (now > 0) {
|
||||
Dbprintf(_YELLOW_("simulating %i blocks"), now);
|
||||
for (int i = 0; i < now; i++)
|
||||
Dbprintf("%2i -> %lx", i + 1, words[i]);
|
||||
|
||||
} else {
|
||||
Dbprintf(_RED_("error in input data"));
|
||||
}
|
||||
|
||||
state_change = false;
|
||||
}
|
||||
|
||||
em4x50_sim_send_listen_window();
|
||||
for (int i = 0; i < now; i++) {
|
||||
em4x50_sim_send_listen_window();
|
||||
em4x50_sim_send_word(words[i]);
|
||||
}
|
||||
|
||||
} else if (state == STATE_READ) {
|
||||
|
||||
if (state_change) {
|
||||
|
||||
LEDsoff();
|
||||
LED_B_ON();
|
||||
Dbprintf("");
|
||||
Dbprintf(_YELLOW_("switched to EM4x50 reading mode"));
|
||||
|
||||
memset(entry, 0, sizeof(entry));
|
||||
memset(words, 0, sizeof(words));
|
||||
|
||||
log_exists = exists_in_spiffs(LF_EM4X50COLLECT_LOGFILE);
|
||||
|
||||
state_change = false;
|
||||
}
|
||||
|
||||
no_words = em4x50_standalone_read(words);
|
||||
|
||||
if (no_words > 0) {
|
||||
|
||||
memset(entry, 0, sizeof(entry));
|
||||
|
||||
sprintf((char *)entry, "found new EM4x50 tag:");
|
||||
Dbprintf("%s", entry);
|
||||
strcat((char *)entry, "\n");
|
||||
append(LF_EM4X50COLLECT_LOGFILE, entry, strlen((char *)entry));
|
||||
|
||||
for (int i = 0; i < no_words; i++) {
|
||||
|
||||
sprintf((char *)entry, " %2i -> 0x%08"PRIx32"", i + 1, words[i]);
|
||||
Dbprintf("%s", entry);
|
||||
strcat((char *)entry, "\n");
|
||||
append(LF_EM4X50COLLECT_LOGFILE, entry, strlen((char *)entry));
|
||||
}
|
||||
}
|
||||
|
||||
} else if (state == STATE_BRUTE) {
|
||||
|
||||
if (state_change) {
|
||||
|
||||
LEDsoff();
|
||||
LED_C_ON();
|
||||
Dbprintf("");
|
||||
Dbprintf(_YELLOW_("switched to EM4x50 brute force mode"));
|
||||
|
||||
log_exists = exists_in_spiffs(LF_EM4X50BRUTE_LOGFILE);
|
||||
now = get_input_data_from_file(passwords, LF_EM4X50BRUTE_INPUTFILE);
|
||||
|
||||
if (now == 2) {
|
||||
|
||||
// print some information
|
||||
int no_iter = passwords[1] - passwords[0] + 1;
|
||||
int dur_s = no_iter / EM4X50_PWD_SPEED;
|
||||
int dur_h = dur_s / 3600;
|
||||
int dur_m = (dur_s - dur_h * 3600) / 60;
|
||||
dur_s -= dur_h * 3600 + dur_m * 60;
|
||||
|
||||
//iterprint = no_iter/10;
|
||||
|
||||
Dbprintf(_YELLOW_("trying %i passwords in range [0x%08x, 0x%08x]"),
|
||||
no_iter, passwords[0], passwords[1]);
|
||||
Dbprintf(_YELLOW_("estimated duration: %ih%im%is"),
|
||||
dur_h, dur_m, dur_s);
|
||||
|
||||
} else {
|
||||
Dbprintf(_RED_("error in input data"));
|
||||
break;
|
||||
}
|
||||
|
||||
state_change = false;
|
||||
}
|
||||
|
||||
pwd_found = em4x50_standalone_brute(passwords[0], passwords[1], &pwd);
|
||||
|
||||
if (pwd_found == PM3_ETIMEOUT) {
|
||||
|
||||
// timeout -> no EM4x50 tag on reader?
|
||||
Dbprintf(_YELLOW_("timeout - no EM4x50 tag detected"));
|
||||
|
||||
} else if (pwd_found == true) {
|
||||
|
||||
// password found -> write to logfile
|
||||
sprintf((char *)entry, "password found: 0x%08"PRIx32, pwd);
|
||||
Dbprintf(_YELLOW_("%s"), entry);
|
||||
strcat((char *)entry, "\n");
|
||||
append(LF_EM4X50BRUTE_LOGFILE, entry, strlen((char *)entry));
|
||||
|
||||
break;
|
||||
|
||||
} else {
|
||||
|
||||
if (pwd == passwords[1] + 1) {
|
||||
|
||||
// finished without success -> write to logfile
|
||||
sprintf((char *)entry, "no password found");
|
||||
Dbprintf(_YELLOW_("%s"), entry);
|
||||
strcat((char *)entry, "\n");
|
||||
append(LF_EM4X50BRUTE_LOGFILE, entry, strlen((char *)entry));
|
||||
|
||||
|
||||
} else {
|
||||
|
||||
// stopped -> write to logfile
|
||||
sprintf((char *)entry, "stopped search - last password: 0x%08"PRIx32, pwd);
|
||||
Dbprintf(_YELLOW_("%s"), entry);
|
||||
strcat((char *)entry, "\n");
|
||||
append(LF_EM4X50BRUTE_LOGFILE, entry, strlen((char *)entry));
|
||||
|
||||
// replace start password by last tested password in
|
||||
// inputfile (spiffs) so that brute forcing process will
|
||||
// be continued when envoking brute force mode again
|
||||
sprintf((char *)entry, "%08"PRIx32"\n%08"PRIx32"\n", pwd, passwords[1]);
|
||||
rdv40_spiffs_write(LF_EM4X50BRUTE_INPUTFILE,
|
||||
entry,
|
||||
strlen((char *)entry),
|
||||
RDV40_SPIFFS_SAFETY_SAFE);
|
||||
|
||||
}
|
||||
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (state == STATE_READ) {
|
||||
DownloadLogInstructions(LF_EM4X50COLLECT_LOGFILE);
|
||||
} else if (state == STATE_BRUTE) {
|
||||
LoadDataInstructions(LF_EM4X50BRUTE_INPUTFILE);
|
||||
DownloadLogInstructions(LF_EM4X50BRUTE_LOGFILE);
|
||||
} else {
|
||||
LoadDataInstructions(LF_EM4X50SIMULATE_INPUTFILE);
|
||||
}
|
||||
|
||||
LED_D_ON();
|
||||
rdv40_spiffs_lazy_unmount();
|
||||
LED_D_OFF();
|
||||
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
LEDsoff();
|
||||
Dbprintf("");
|
||||
Dbprintf(_YELLOW_("[=] Standalone mode THAREXDE stopped"));
|
||||
|
||||
}
|
||||
|
|
@ -45,6 +45,7 @@
|
|||
|
||||
#define EM4X50_TAG_TOLERANCE 8
|
||||
#define EM4X50_TAG_WORD 45
|
||||
#define EM4X50_TAG_MAX_NO_BYTES 136
|
||||
|
||||
#define EM4X50_COMMAND_LOGIN 0x01
|
||||
#define EM4X50_COMMAND_RESET 0x80
|
||||
|
|
@ -690,7 +691,7 @@ static bool em4x50_sim_send_byte_with_parity(uint8_t byte) {
|
|||
return true;
|
||||
}
|
||||
|
||||
bool em4x50_sim_send_word(uint32_t word) {
|
||||
static bool em4x50_sim_send_word(uint32_t word) {
|
||||
|
||||
uint8_t cparity = 0x00;
|
||||
|
||||
|
|
@ -721,7 +722,7 @@ bool em4x50_sim_send_word(uint32_t word) {
|
|||
return true;
|
||||
}
|
||||
|
||||
bool em4x50_sim_send_listen_window(void) {
|
||||
static bool em4x50_sim_send_listen_window(void) {
|
||||
|
||||
uint16_t check = 0;
|
||||
|
||||
|
|
@ -1015,8 +1016,7 @@ void em4x50_read(em4x50_data_t *etd) {
|
|||
LOW(GPIO_SSC_DOUT);
|
||||
lf_finalize();
|
||||
|
||||
// iceman: this hardcoded 136 value....
|
||||
reply_ng(CMD_LF_EM4X50_READ, status, (uint8_t *)words, 136);
|
||||
reply_ng(CMD_LF_EM4X50_READ, status, (uint8_t *)words, EM4X50_TAG_MAX_NO_BYTES);
|
||||
}
|
||||
|
||||
// collects as much information as possible via selective read mode
|
||||
|
|
@ -1041,8 +1041,7 @@ void em4x50_info(em4x50_data_t *etd) {
|
|||
|
||||
lf_finalize();
|
||||
|
||||
// iceman: this hardcoded 136 value....
|
||||
reply_ng(CMD_LF_EM4X50_INFO, status, (uint8_t *)words, 136);
|
||||
reply_ng(CMD_LF_EM4X50_INFO, status, (uint8_t *)words, EM4X50_TAG_MAX_NO_BYTES);
|
||||
}
|
||||
|
||||
// reads data that tag transmits "voluntarily" -> standard read mode
|
||||
|
|
@ -1193,7 +1192,7 @@ void em4x50_write(em4x50_data_t *etd) {
|
|||
}
|
||||
|
||||
lf_finalize();
|
||||
reply_ng(CMD_LF_EM4X50_WRITE, status, (uint8_t *)words, 136);
|
||||
reply_ng(CMD_LF_EM4X50_WRITE, status, (uint8_t *)words, EM4X50_TAG_MAX_NO_BYTES);
|
||||
}
|
||||
|
||||
// simple change of password
|
||||
|
|
|
|||
|
|
@ -13,11 +13,6 @@
|
|||
|
||||
#include "../include/em4x50.h"
|
||||
|
||||
int em4x50_standalone_read(uint32_t *words);
|
||||
int em4x50_standalone_brute(uint32_t start, uint32_t stop, uint32_t *pwd);
|
||||
bool em4x50_sim_send_listen_window(void);
|
||||
bool em4x50_sim_send_word(uint32_t word);
|
||||
|
||||
void em4x50_info(em4x50_data_t *etd);
|
||||
void em4x50_write(em4x50_data_t *etd);
|
||||
void em4x50_writepwd(em4x50_data_t *etd);
|
||||
|
|
|
|||
|
|
@ -259,6 +259,48 @@ int CmdEM4x50ESave(const char *Cmd) {
|
|||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
int CmdEM4x50EView(const char *Cmd) {
|
||||
|
||||
CLIParserContext *ctx;
|
||||
CLIParserInit(&ctx, "lf em 4x50 eview",
|
||||
"Displays em4x50 content of emulator memory.",
|
||||
"lf em 4x50 eview\n"
|
||||
);
|
||||
|
||||
void *argtable[] = {
|
||||
arg_param_begin,
|
||||
arg_param_end
|
||||
};
|
||||
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, true);
|
||||
CLIParserFree(ctx);
|
||||
|
||||
// download emulator memory
|
||||
PrintAndLogEx(SUCCESS, "Reading emulator memory...");
|
||||
uint8_t data[DUMP_FILESIZE] = {0x0};
|
||||
if (GetFromDevice(BIG_BUF_EML, data, DUMP_FILESIZE, 0, NULL, 0, NULL, 2500, false) == false) {
|
||||
PrintAndLogEx(WARNING, "Fail, transfer from device time-out");
|
||||
return PM3_ETIMEOUT;
|
||||
}
|
||||
|
||||
// valid em4x50 data?
|
||||
uint32_t serial = bytes_to_num(data + 4 * EM4X50_DEVICE_SERIAL, 4);
|
||||
uint32_t device_id = bytes_to_num(data + 4 * EM4X50_DEVICE_ID, 4);
|
||||
if (serial == device_id) {
|
||||
PrintAndLogEx(WARNING, "No valid em4x50 data in emulator memory.");
|
||||
return PM3_ENODATA;
|
||||
}
|
||||
|
||||
em4x50_word_t words[EM4X50_NO_WORDS];
|
||||
for (int i = 0; i < EM4X50_NO_WORDS; i++) {
|
||||
memcpy(words[i].byte, data + i * 4, 4);
|
||||
}
|
||||
print_result(words, 0, EM4X50_NO_WORDS - 1);
|
||||
PrintAndLogEx(NORMAL, "");
|
||||
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
int CmdEM4x50Login(const char *Cmd) {
|
||||
CLIParserContext *ctx;
|
||||
CLIParserInit(&ctx, "lf em 4x50 login",
|
||||
|
|
@ -1123,8 +1165,9 @@ static command_t CommandTable[] = {
|
|||
{"reader", CmdEM4x50Reader, IfPm3EM4x50, "show standard read mode data of EM4x50"},
|
||||
{"restore", CmdEM4x50Restore, IfPm3EM4x50, "restore EM4x50 dump to tag"},
|
||||
{"sim", CmdEM4x50Sim, IfPm3EM4x50, "simulate EM4x50 tag"},
|
||||
{"eload", CmdEM4x50ELoad, IfPm3EM4x50, "upload dump of EM4x50 to flash memory"},
|
||||
{"esave", CmdEM4x50ESave, IfPm3EM4x50, "save flash memory to file"},
|
||||
{"eload", CmdEM4x50ELoad, IfPm3EM4x50, "upload dump of EM4x50 to emulator memory"},
|
||||
{"esave", CmdEM4x50ESave, IfPm3EM4x50, "save emulator memory to file"},
|
||||
{"eview", CmdEM4x50EView, IfPm3EM4x50, "view EM4x50 content in emulator memory"},
|
||||
{NULL, NULL, NULL, NULL}
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -33,5 +33,6 @@ int CmdEM4x50Reader(const char *Cmd);
|
|||
int CmdEM4x50ELoad(const char *Cmd);
|
||||
int CmdEM4x50ESave(const char *Cmd);
|
||||
int CmdEM4x50Chk(const char *Cmd);
|
||||
int CmdEM4x50EView(const char *Cmd);
|
||||
|
||||
#endif
|
||||
|
|
|
|||
Loading…
Reference in a new issue