125Khz RFID spoofing - Cronologia

Renzo: /* Circuit schematics */

2023-03-13T17:55:41Z

Circuit schematics

Renzo: /* Circuit schematics */

2023-03-13T17:53:45Z

Circuit schematics

Renzo: /* Code */

2019-04-08T06:56:48Z

Code

Renzo: /* Circuit schematics */

2019-04-07T16:20:55Z

Circuit schematics

Renzo il 16:18, 7 apr 2019

2019-04-07T16:18:10Z

Renzo il 16:14, 7 apr 2019

2019-04-07T16:14:48Z

Renzo il 16:12, 7 apr 2019

2019-04-07T16:12:38Z

Renzo il 16:08, 7 apr 2019

2019-04-07T16:08:44Z

Renzo: /* Circuit schematics */

2019-04-07T16:07:47Z

Circuit schematics

Renzo: Creata pagina con '== Circuit schematics == 450px List of materials: * an antenna (there are many 125khz antennas on e-bay) * Capacitor 1nF (maybe this valu...'

2019-04-07T15:52:14Z

Creata pagina con '== Circuit schematics == 450px List of materials: * an antenna (there are many 125khz antennas on e-bay) * Capacitor 1nF (maybe this valu...'

Nuova pagina

== Circuit schematics ==

[[File:rfid125spoofschematics.jpg|450px]]

List of materials:
* an antenna (there are many 125khz antennas on e-bay)
* Capacitor 1nF (maybe this value must be tuned for the best resonance of the antenna)
* 4 diodes 1N4148
* Resistor 100Kohm
* zener diode 5.1v

== Usage ==

[[File:rfid125spoof.jpg|450px]]

Connect the two terminals of the circuit to GND and pin 12.

Compile and Load the code herebelow.

Open a serial terminal (9600 bit/s), e.g.

screen /dev/ttyUSB0 9600

Type in 10 hexadecimal digits (characters are not echoed).
(the code computes all the parity bits, both horizontal and vertical).

== Code ==
<pre>
#define coil_pin 12

char data[10];
int data_count =0;

int spoofed_card[64] = {1,1,1,1,1,1,1,1,1}; //header

void setup()
{
pinMode(coil_pin, OUTPUT);
digitalWrite(coil_pin, LOW);
Serial.begin(9600);
}

void loop()
{
if(Serial.available()){
char key = Serial.read();
if(key != '\0') {
data[data_count] = key;
if(data_count == 9){
spoofcard();
data_count = 0;
}
else
data_count ++;
}
}
}

void compute_data(){
// Compute raw data
int data_iterator;
int bit;
int bit_set;
for(bit = 0, data_iterator = 0; bit < 59; bit += 5, data_iterator++){
int raw_data = HexToDec(data[data_iterator]);
spoofed_card[bit+9] = !! (raw_data & 8);
spoofed_card[bit+10] = !! (raw_data & 4);
spoofed_card[bit+11] = !! (raw_data & 2);
spoofed_card[bit+12] = !! (raw_data & 1);
}

int i = 8;
// CRC ROW
for(int c = 3; c < 13; c++){
bit_set = 0;
for(i++; i < ((c * 5) - 2); i++)
if(spoofed_card[i]) bit_set++;
spoofed_card[(c * 5)-2] = ((bit_set % 2) != 0);
}

// CRC COL
for(int c = 0; c < 4; c++){
bit_set = 0;
for(int a = 9; a < 55; a += 5){
if(spoofed_card[a + c]) bit_set++;
}
spoofed_card[c + 59] = ((bit_set % 2) != 0);
}
}

void spoofcard(){
compute_data();
for(int h = 0; h < 50; h++)
spoofnow();
}

void send_manchester(int clock_half, int signal)
{
int man_encoded = clock_half ^ signal;

if(man_encoded == 1)
digitalWrite(coil_pin, LOW);
else
digitalWrite(coil_pin, HIGH);
}

void spoofnow(){
for(int i = 0; i < 64; i++)
{
send_manchester(0, spoofed_card[i]);
delayMicroseconds(256);
send_manchester(1, spoofed_card[i]);
delayMicroseconds(256);
}
}

int HexToDec(char hexa)
{
if (hexa >= '0' && hexa <= '9')
return hexa - '0';
else if (hexa >= 'A' && hexa <= 'F')
return hexa - 'A' + 10;
else if (hexa >= 'a' && hexa <= 'f')
return hexa - 'a' + 10;
else
return 0;
}
</pre>

@@ Riga 1: / Riga 1: @@
 == Circuit schematics ==
-[[File:rfid125spoofschematics2.png|450px]]
+[[File:rfid125spoofschematics.png|450px]]
 List of materials:

@@ Riga 1: / Riga 1: @@
 == Circuit schematics ==
-[[File:rfid125spoofschematics.png|450px]]
+[[File:rfid125spoofschematics2.png|450px]]
 List of materials:

@@ Riga 32: / Riga 32: @@
 int data_count =0;
-int spoofed_card[64] = {1,1,1,1,1,1,1,1,1}; //header
+unsigned char spoofed_card[64];
 void setup()
@@ Riga 57: / Riga 57: @@
+}
-void compute_data(){
+int hexchar(char hexa)
-        // Compute raw data
-        int data_iterator;
+  if (hexa >= '0' && hexa <= '9')
-        int bit;
+    return hexa - '0';
-        int bit_set;
+  else if (hexa >= 'A' && hexa <= 'F')
-        for(bit = 0, data_iterator = 0; bit < 59; bit += 5, data_iterator++){
+    return hexa - 'A' + 10;
-                int raw_data = HexToDec(data[data_iterator]);
+  else if (hexa >= 'a' && hexa <= 'f')
-                spoofed_card[bit+9] = !! (raw_data & 8);
+    return hexa - 'a' + 10;
-                spoofed_card[bit+10] = !! (raw_data & 4);
+  else
-                spoofed_card[bit+11] = !! (raw_data & 2);
+    return 0;
-                spoofed_card[bit+12] = !! (raw_data & 1);
-        // CRC COL
+//http://www.priority1design.com.au/em4100_protocol.html
-        for(int c = 0; c < 4; c++){
+void compute_em4100(char *in, unsigned char *out) {
-                bit_set = 0;
+  int i;
-                for(int a = 9; a < 55; a += 5){
+  int j;
-                        if(spoofed_card[a + c]) bit_set++;
+  int parity;
+  static const int prefix = 9;
-                spoofed_card[c + 59] = ((bit_set % 2) != 0);
+  for (i = 0; i < prefix; i++)
+    out[i] = 1;
+}
 void spoofcard(){
-         compute_data();
+         compute_em4100(data, spoofed_card);
          for(int h = 0; h < 50; h++)
                  spoofnow();
@@ Riga 113: / Riga 121: @@
                  delayMicroseconds(256);
+         }
+}
 </pre>

@@ Riga 5: / Riga 5: @@
 List of materials:
 * an antenna (there are many 125khz antennas on e-bay)
-* Capacitor 1nF (maybe this value must be tuned for the best resonance of the antenna)
+* Capacitor 1nF (maybe this value needs some tuning for the best resonance of the antenna)
 * 4 diodes 1N4148
 * Resistor 100Kohm