search

iceman1001 / proxmark3

[Deprecated] Iceman Fork, the most totally wicked fork around if you are into proxmark3
http://www.icedev.se/pm3.aspx
GNU General Public License v2.0
466 stars 116 forks source link

Add support for 36bit HID tags, extend calcWiegand to include OEM bits #285

Closed davidbeauchamp closed 5 years ago

davidbeauchamp commented 5 years ago

I came across a bag full of HID tags using this format that I couldn't find documented anywhere. After some poking and prodding at the bits I worked out the format and figured I would contribute the addition. I added support to the demoudulator, tested reading, cloning, wiegand output, and simulation. I did not add support for this format to the brute forcer as it would require refactoring to support the OEM segment, and just hard coded a 0 into the OEM parameter added to clacWiegand inside the brute forcing code.

This format is backwards in that the parity logic is swapped, so I duplicated the existing function to do this. Plenty of head scratching to finally figure that out as none of the other HID formats seem to be encoded this way.

Format Details:

FC     1  - 16  - 16 bit
cardno 17 - 33  - 16 bit
oem    34 - 35  -  2 bit
Odd  Parity  0th bit  1-17
Even Parity 36th bit 18-35

Some example bitstreams, card number is printed on tag along with sales order number from original purchase:

1 1011000000010000 0101101110100000 00 1 FC = 45072, Card = 23456, OEM = 0
1 1011000000010000 0101101111000001 00 0 FC = 45072, Card = 23489, OEM = 0
1 1011000000010000 0101101111100111 00 1 FC = 45072, Card = 23527, OEM = 0
1 1011000000010000 0110000100000100 00 0 FC = 45072, Card = 24836, OEM = 0
1 1011000000010000 0110000000110001 00 1 FC = 45072, Card = 24625, OEM = 0
iceman1001 commented 5 years ago

Excellent, haven't seen someone make a PR with so much pointer woodo for awhile. :)

Now, can you do the same over at the RRG repo? https://github.com/RfidResearchGroup/proxmark3