Skip to content

Commit

Permalink
added legic view command, and converted OLD -> NG comms
Browse files Browse the repository at this point in the history
  • Loading branch information
iceman1001 committed Feb 14, 2022
1 parent 12695a9 commit 63bc9b5
Show file tree
Hide file tree
Showing 7 changed files with 261 additions and 91 deletions.
2 changes: 2 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,8 @@ All notable changes to this project will be documented in this file.
This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...

## [unreleased][unreleased]
- Changed `hf legic *` - now uses NG instead (@iceman1001)
- Added `hf legic view` - view contents of LEGIC Prime dump files (@iceman1001)
- Changed `hf mfu restore` - now takes bin/json as dump files (@iceman1001)
- Added `hf mfu view` - view contents of MFU dump files (@iceman1001)
- Changed `hf_mf_uidbruteforce` - added support for S70, enhance UID length management (@cactuschibre)
Expand Down
11 changes: 6 additions & 5 deletions armsrc/appmain.c
Original file line number Diff line number Diff line change
Expand Up @@ -1285,11 +1285,13 @@ static void PacketReceived(PacketCommandNG *packet) {
break;
}
case CMD_HF_LEGIC_WRITER: {
LegicRfWriter(packet->oldarg[0], packet->oldarg[1], packet->oldarg[2], packet->data.asBytes);
legic_packet_t *payload = (legic_packet_t*) packet->data.asBytes;
LegicRfWriter(payload->offset, payload->len, payload->iv, payload->data);
break;
}
case CMD_HF_LEGIC_READER: {
LegicRfReader(packet->oldarg[0], packet->oldarg[1], packet->oldarg[2]);
legic_packet_t *payload = (legic_packet_t*) packet->data.asBytes;
LegicRfReader(payload->offset, payload->len, payload->iv);
break;
}
case CMD_HF_LEGIC_INFO: {
Expand All @@ -1302,10 +1304,9 @@ static void PacketReceived(PacketCommandNG *packet) {
// involved in dealing with emulator memory. But if it is called later, it might
// destroy the Emulator Memory.
//-----------------------------------------------------------------------------
// arg0 = offset
// arg1 = num of bytes
FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
emlSet(packet->data.asBytes, packet->oldarg[0], packet->oldarg[1]);
legic_packet_t *payload = (legic_packet_t*) packet->data.asBytes;
emlSet(payload->data, payload->offset, payload->len);
break;
}
#endif
Expand Down
22 changes: 11 additions & 11 deletions armsrc/legicrf.c
Original file line number Diff line number Diff line change
Expand Up @@ -422,15 +422,15 @@ void LegicRfInfo(void) {
// establish shared secret and detect card type
uint8_t card_type = setup_phase(0x01);
if (init_card(card_type, &card) != PM3_SUCCESS) {
reply_mix(CMD_ACK, 0, 0, 0, 0, 0);
reply_ng(CMD_HF_LEGIC_INFO, PM3_EINIT, NULL, 0);
goto OUT;
}

// read UID
for (uint8_t i = 0; i < sizeof(card.uid); ++i) {
int16_t byte = read_byte(i, card.cmdsize);
if (byte == -1) {
reply_mix(CMD_ACK, 0, 0, 0, 0, 0);
reply_ng(CMD_HF_LEGIC_INFO, PM3_EFAILED, NULL, 0);
goto OUT;
}
card.uid[i] = byte & 0xFF;
Expand All @@ -440,12 +440,12 @@ void LegicRfInfo(void) {
int16_t mcc = read_byte(4, card.cmdsize);
int16_t calc_mcc = CRC8Legic(card.uid, 4);
if (mcc != calc_mcc) {
reply_mix(CMD_ACK, 0, 0, 0, 0, 0);
reply_ng(CMD_HF_LEGIC_INFO, PM3_ESOFT, NULL, 0);
goto OUT;
}

// OK
reply_mix(CMD_ACK, 1, 0, 0, (uint8_t *)&card, sizeof(legic_card_select_t));
reply_ng(CMD_HF_LEGIC_INFO, PM3_SUCCESS, (uint8_t *)&card, sizeof(legic_card_select_t));

OUT:
switch_off();
Expand Down Expand Up @@ -497,7 +497,7 @@ void LegicRfReader(uint16_t offset, uint16_t len, uint8_t iv) {
// establish shared secret and detect card type
uint8_t card_type = setup_phase(iv);
if (init_card(card_type, &card) != PM3_SUCCESS) {
reply_mix(CMD_ACK, 0, 0, 0, 0, 0);
reply_ng(CMD_HF_LEGIC_READER, PM3_EINIT, NULL, 0);
goto OUT;
}

Expand All @@ -509,7 +509,7 @@ void LegicRfReader(uint16_t offset, uint16_t len, uint8_t iv) {
for (uint16_t i = 0; i < len; ++i) {
int16_t byte = read_byte(offset + i, card.cmdsize);
if (byte == -1) {
reply_mix(CMD_ACK, 0, 0, 0, 0, 0);
reply_ng(CMD_HF_LEGIC_READER, PM3_EFAILED, NULL, 0);
goto OUT;
}
legic_mem[i] = byte;
Expand All @@ -520,7 +520,7 @@ void LegicRfReader(uint16_t offset, uint16_t len, uint8_t iv) {
}

// OK
reply_mix(CMD_ACK, 1, len, 0, 0, 0);
reply_ng(CMD_HF_LEGIC_READER, PM3_SUCCESS, (uint8_t*)&len, sizeof(len));

OUT:
switch_off();
Expand All @@ -533,14 +533,14 @@ void LegicRfWriter(uint16_t offset, uint16_t len, uint8_t iv, uint8_t *data) {

// uid is not writeable
if (offset <= WRITE_LOWERLIMIT) {
reply_mix(CMD_ACK, 0, 0, 0, 0, 0);
reply_ng(CMD_HF_LEGIC_WRITER, PM3_EINVARG, NULL, 0);
goto OUT;
}

// establish shared secret and detect card type
uint8_t card_type = setup_phase(iv);
if (init_card(card_type, &card) != PM3_SUCCESS) {
reply_mix(CMD_ACK, 0, 0, 0, 0, 0);
reply_ng(CMD_HF_LEGIC_WRITER, PM3_EINIT, NULL, 0);
goto OUT;
}

Expand All @@ -553,13 +553,13 @@ void LegicRfWriter(uint16_t offset, uint16_t len, uint8_t iv, uint8_t *data) {
while (len-- > 0 && BUTTON_PRESS() == false) {
if (write_byte(len + offset, data[len], card.addrsize) == false) {
Dbprintf("operation failed | %02X | %02X | %02X", len + offset, len, data[len]);
reply_mix(CMD_ACK, 0, 0, 0, 0, 0);
reply_ng(CMD_HF_LEGIC_WRITER, PM3_EFAILED, NULL, 0);
goto OUT;
}
}

// OK
reply_mix(CMD_ACK, 1, len, 0, 0, 0);
reply_ng(CMD_HF_LEGIC_WRITER, PM3_SUCCESS, (uint8_t*)&len, sizeof(len));

OUT:
switch_off();
Expand Down
11 changes: 3 additions & 8 deletions client/luascripts/hf_legic_clone.lua
Original file line number Diff line number Diff line change
Expand Up @@ -170,14 +170,9 @@ end
-- read LEGIC data
local function readlegicdata(offset, length, iv)
-- Read data
local command = Command:newMIX{
cmd = cmds.CMD_HF_LEGIC_READER
, arg1 = offset
, arg2 = length
, arg3 = iv
, data = nil
}
local result, err = command:sendMIX()
local d0 = ('%04X%04X%02X'):format(offset, len, iv)
local c = Command:newNG{cmd = cmds.CMD_HF_LEGIC_READER, data = d0}
local result, err = c:sendNG()
if not result then return oops(err) end
-- result is a packed data structure, data starts at offset 33
return result
Expand Down
Loading

0 comments on commit 63bc9b5

Please sign in to comment.