Skip to content

Commit

Permalink
Standalone mode hf_legicsim
Browse files Browse the repository at this point in the history
Add a standalone mode to simulate Legic Prime dumps stored on flash
  • Loading branch information
uhei committed Feb 15, 2022
1 parent 2e151e9 commit 12ed4f1
Show file tree
Hide file tree
Showing 6 changed files with 165 additions and 4 deletions.
1 change: 1 addition & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file.
This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...

## [unreleased][unreleased]
- Added new standalone mode `hf_legicsim` (@uhei)
- Changed `hf legic *` - now uses NG instead (@iceman1001)
- Added `hf legic view` - view contents of LEGIC Prime dump files (@iceman1001)
- Changed `hf mfu restore` - now takes bin/json as dump files (@iceman1001)
Expand Down
7 changes: 5 additions & 2 deletions armsrc/Standalone/Makefile.hal
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,9 @@ define KNOWN_STANDALONE_DEFINITIONS
| HF_LEGIC | Read/simulate Legic Prime tags |
| | storing in flashmem |
+----------------------------------------------------------+
| HF_LEGICSIM | Simulate Legic Prime tags |
| (RDV4 only) | stored on flashmem |
+----------------------------------------------------------+
| HF_MATTYRUN | Mifare sniff/clone |
| | - Matías A. Ré Medina |
+----------------------------------------------------------+
Expand Down Expand Up @@ -113,10 +116,10 @@ define KNOWN_STANDALONE_DEFINITIONS
endef

STANDALONE_MODES := LF_SKELETON LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RSWW LF_EM4100RWC LF_HIDBRUTE LF_HIDFCBRUTE LF_ICEHID LF_PROXBRUTE LF_SAMYRUN LF_THAREXDE LF_NEXID
STANDALONE_MODES += HF_14ASNIFF HF_15SNIFF HF_AVEFUL HF_BOG HF_COLIN HF_CRAFTBYTE HF_ICECLASS HF_LEGIC HF_MATTYRUN HF_MFCSIM HF_MSDSAL HF_TCPRST HF_TMUDFORD HF_YOUNG HF_REBLAY DANKARMULTI
STANDALONE_MODES += HF_14ASNIFF HF_15SNIFF HF_AVEFUL HF_BOG HF_COLIN HF_CRAFTBYTE HF_ICECLASS HF_LEGIC HF_LEGICSIM HF_MATTYRUN HF_MFCSIM HF_MSDSAL HF_TCPRST HF_TMUDFORD HF_YOUNG HF_REBLAY DANKARMULTI
STANDALONE_MODES_REQ_BT := HF_REBLAY
STANDALONE_MODES_REQ_SMARTCARD :=
STANDALONE_MODES_REQ_FLASH := LF_HIDFCBRUTE LF_ICEHID LF_NEXID LF_THAREXDE HF_14ASNIFF HF_15SNIFF HF_BOG HF_COLIN HF_ICECLASS HF_MFCSIM
STANDALONE_MODES_REQ_FLASH := LF_HIDFCBRUTE LF_ICEHID LF_NEXID LF_THAREXDE HF_14ASNIFF HF_15SNIFF HF_BOG HF_COLIN HF_ICECLASS HF_MFCSIM HF_LEGICSIM
ifneq ($(filter $(STANDALONE),$(STANDALONE_MODES)),)
STANDALONE_PLATFORM_DEFS += -DWITH_STANDALONE_$(STANDALONE)
ifneq ($(filter $(STANDALONE),$(STANDALONE_MODES_REQ_SMARTCARD)),)
Expand Down
4 changes: 4 additions & 0 deletions armsrc/Standalone/Makefile.inc
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,10 @@ endif
ifneq (,$(findstring WITH_STANDALONE_HF_LEGIC,$(APP_CFLAGS)))
SRC_STANDALONE = hf_legic.c
endif
# WITH_STANDALONE_HF_LEGICSIM
ifneq (,$(findstring WITH_STANDALONE_HF_LEGICSIM,$(APP_CFLAGS)))
SRC_STANDALONE = hf_legicsim.c
endif
# WITH_STANDALONE_HF_MSDSAL
ifneq (,$(findstring WITH_STANDALONE_HF_MSDSAL,$(APP_CFLAGS)))
SRC_STANDALONE = hf_msdsal.c
Expand Down
152 changes: 152 additions & 0 deletions armsrc/Standalone/hf_legicsim.c
Original file line number Diff line number Diff line change
@@ -0,0 +1,152 @@
//-----------------------------------------------------------------------------
// Copyright (C) Uli Heilmeier, 2022
// Copyright (C) Proxmark3 contributors. See AUTHORS.md for details.
// Based on hf_mfcsim by Ray Lee
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// See LICENSE.txt for the text of the license.
//-----------------------------------------------------------------------------
// main code for legic prime simulator aka LEGICSIM
//-----------------------------------------------------------------------------
#include <inttypes.h>
#include "ticks.h"
#include "proxmark3_arm.h"
#include "BigBuf.h"
#include "commonutil.h"
#include "fpgaloader.h"
#include "util.h"
#include "dbprint.h"
#include "spiffs.h"
#include "standalone.h" // standalone definitions
#include "appmain.h"
#include "string.h"
#include "legicrf.h"
#include "legicrfsim.h"
#include "legic.h"

/*
* `hf_legicsim` simulates legic prime MIM1024 dumps uploaded to flash.
* It requires RDV4 hardware (for flash and battery).
*
* On entering stand-alone mode, this module will start simulating.
* Data is read from bin dump file uploaded to flash memory (hf_legicsim_dump_xx.bin).
* Only support legic prime MIM1024
*
* To upload input file (eml format) to flash:
* - mem spiffs upload -s <filename> -d hf_legicsim_dump_xx.bin (Notes: xx is form 01 to 15)
* To delete the input file from flash:
* - mem spiffs remove -f hf_legicsim_dump_xx.bin (Notes: xx is form 01 to 15)
*
*/

#define HF_LEGICSIM_DUMPFILE_SIM "hf_legicsim_dump_%02d.bin"
#define DUMP_SIZE 1024

static char cur_dump_file[24] = {0};

static bool fill_eml_from_file(char *dumpfile) {
// check file exist
if (!exists_in_spiffs(dumpfile)) {
Dbprintf(_RED_("Dump file %s not found!"), dumpfile);
return false;
}
//check dumpfile size
uint32_t size = size_in_spiffs(dumpfile);
if (size != DUMP_SIZE) {
Dbprintf(_RED_("File Size: %dB The dump file size is incorrect! Only support Legic Prime MIM1024! Please check it."));
BigBuf_free();
return false;
}
//read and load dump file
BigBuf_Clear();
if (g_dbglevel >= DBG_INFO)
Dbprintf(_YELLOW_("Found dump file %s. Uploading to emulator memory..."), dumpfile);
uint8_t *emCARD = BigBuf_get_EM_addr();
rdv40_spiffs_read_as_filetype(dumpfile, emCARD, size, RDV40_SPIFFS_SAFETY_SAFE);
return true;
}

static bool write_file_from_eml(char *dumpfile) {
if (!exists_in_spiffs(dumpfile)) {
Dbprintf(_RED_("Dump file %s not found!"), dumpfile);
return false;
}
uint8_t *emCARD = BigBuf_get_EM_addr();
rdv40_spiffs_write(dumpfile, emCARD, DUMP_SIZE, RDV40_SPIFFS_SAFETY_SAFE);
return true;
}

void ModInfo(void) {
DbpString(_YELLOW_(" HF Legic Prime simulation mode") " - a.k.a LEGICSIM");
}

void RunMod(void) {
//initializing
StandAloneMode();
FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
rdv40_spiffs_lazy_mount();
Dbprintf(_YELLOW_("Standalone mode LEGICSIM started!"));

bool flag_has_dumpfile = false;
for (int i = 1;; i++) {
//Exit! usbcommand break
if (data_available()) break;

//Infinite loop
if (i > 15) {
if (!flag_has_dumpfile)
break; //still no dump file found
i = 1; //next loop
}

//Indicate which card will be simulated
LED(i, 0);

//Try to load dump form flash
sprintf(cur_dump_file, HF_LEGICSIM_DUMPFILE_SIM, i);
Dbprintf(_YELLOW_("[Slot: %d] Try to load dump file: %s"), i, cur_dump_file);
if (!fill_eml_from_file(cur_dump_file)) {
Dbprintf(_YELLOW_("[Slot: %d] Dump load Failed, Next one!"), i);
LEDsoff();
continue;
}
flag_has_dumpfile = true;

//Exit! Button hold break
int button_pressed = BUTTON_HELD(500);
if (button_pressed == BUTTON_HOLD) {
Dbprintf("Button hold, Break!");
break;
}

//Hope there is enough time to see clearly
SpinDelay(500);

//Start to simulate

Dbprintf(_YELLOW_("[Slot: %d] Simulation start, Press button to change next card."), i);
LegicRfSimulate(2, false);
Dbprintf(_YELLOW_("[Slot: %d] Simulation end, Write Back to dump file!"), i);

//Simulation end, Write Back
if (!write_file_from_eml(cur_dump_file)) {
Dbprintf(_RED_("[Slot: %d] Write Failed! Anyway, Change to next one!"), i);
continue;
}
Dbprintf(_YELLOW_("[Slot: %d] Write Success! Change to next one!"), i);
}
if (!flag_has_dumpfile)
Dbprintf("No dump file found!");
Dbprintf("Breaked! Exit standalone mode!");
SpinErr(15, 200, 3);
return;
}
3 changes: 2 additions & 1 deletion doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md
Original file line number Diff line number Diff line change
Expand Up @@ -120,7 +120,8 @@ Here are the supported values you can assign to `STANDALONE` in `Makefile.platfo
| HF_CRAFTBYTE | UID stealer - Emulates scanned 14a UID - Anze Jensterle
| HF_COLIN | Mifare ultra fast sniff/sim/clone - Colin Brigato
| HF_ICECLASS | iCLASS 4-1 mode sim/read & dump/loclass/glitch & config to flashmem - Iceman1001
| HF_LEGIC | HF Legic Prime standalone - uhei
| HF_LEGIC | HF Legic Prime Read/Store/Sim standalone - uhei
| HF_LEGICSIM | HF Legic Prime Simulate standalone - uhei
| HF_MATTYRUN | Mifare sniff/clone - Matías A. Ré Medina
| HF_MFCSIM | Simulate Mifare Classic 1k card storing in flashmem - Ray Lee
| HF_MSDSAL | EMV Read and emulation - Salvador Mendoza
Expand Down
2 changes: 1 addition & 1 deletion tools/build_all_firmwares.sh
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ mv bootrom/obj/bootrom.elf "$DEST/PM3BOOTROM.elf"

# cf armsrc/Standalone/Makefile.hal
STANDALONE_MODES=(LF_SKELETON LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RSWW LF_EM4100RWC LF_HIDBRUTE LF_HIDFCBRUTE LF_ICEHID LF_PROXBRUTE LF_SAMYRUN LF_THAREXDE LF_NEXID)
STANDALONE_MODES+=(HF_14ASNIFF HF_15SNIFF HF_AVEFUL HF_BOG HF_COLIN HF_CRAFTBYTE HF_ICECLASS HF_LEGIC HF_MATTYRUN HF_MFCSIM HF_MSDSAL HF_TCPRST HF_TMUDFORD HF_YOUNG HF_REBLAY DANKARMULTI)
STANDALONE_MODES+=(HF_14ASNIFF HF_15SNIFF HF_AVEFUL HF_BOG HF_COLIN HF_CRAFTBYTE HF_ICECLASS HF_LEGIC HF_LEGICSIM HF_MATTYRUN HF_MFCSIM HF_MSDSAL HF_TCPRST HF_TMUDFORD HF_YOUNG HF_REBLAY DANKARMULTI)
STANDALONE_MODES_REQ_BT=(HF_REBLAY)
STANDALONE_MODES_REQ_SMARTCARD=()
STANDALONE_MODES_REQ_FLASH=(LF_HIDFCBRUTE LF_ICEHID LF_NEXID LF_THAREXDE HF_14ASNIFF HF_15SNIFF HF_BOG HF_COLIN HF_ICECLASS HF_MFCSIM)
Expand Down

0 comments on commit 12ed4f1

Please sign in to comment.