├── AudioSpoof.c
└── README.md


/AudioSpoof.c:
--------------------------------------------------------------------------------
  1 | /* Original code - Magnetic Stripe Encoder by geohot
  2 | *
  3 | - Modified by Salvador Mendoza (https://salmg.net/2017/01/06/how-to-transmit-mag-stripe-info-through-audio/)
  4 | - Adding some code from Samy Kamkar 
  5 | - for a better parity check and wave generation (https://github.com/samyk/magspoof/)
  6 | -
  7 | - Thanks to Luis Colunga (https://twitter.com/sinnet3000)
  8 | */
  9 | 
 10 | #include <stdio.h>
 11 | #include <stdlib.h>
 12 | #include <string.h>
 13 | 
 14 | unsigned char wave_buffer[0x10000];
 15 | int wave_ptr=0;
 16 | unsigned char highchunk[]={ 0xff,0xff,0xff,0xff,0xff };
 17 | unsigned char lowchunk[]={ 0,0,0,0,0 };
 18 | unsigned int curTrack = 0;
 19 | struct riff_chunk{
 20 |        char chunk_id[4];
 21 |        int file_size;
 22 |        char riff_type[4];
 23 | };
 24 | struct fmt_chunk{
 25 |        char chunk_id[4];
 26 |        int chunk_size;
 27 |        short int compression_code;
 28 |        short int num_channels;
 29 |        int sample_rate;
 30 |        int bytes_second;
 31 |        short int block_align;
 32 |        short int bits_sample;
 33 | };
 34 | const int sublen[] = {
 35 |   32, 48, 48 };
 36 | const int bitlen[] = {
 37 |   7, 5, 5 };
 38 | const char* tracks[] = {
 39 |     "%B123456781234567^LASTNAME/FIRST^YYMMSSSDDDDDDDDDDDDDDDDDDDDDDDDD?\0", // Track 1
 40 |     ";123456781234567=00000001111111111111?\0" // Track 2
 41 | };
 42 | int dir;
 43 | 
 44 | void lowChunk(int many){
 45 |     for(int n=0; n<many; n++){
 46 |         memcpy(wave_buffer+wave_ptr, lowchunk, sizeof(lowchunk)); 
 47 |         wave_ptr+=sizeof(lowchunk);
 48 |     }
 49 | }
 50 | void highChunk(int many){
 51 |     for(int n=0; n<many; n++){
 52 |         memcpy(wave_buffer+wave_ptr, highchunk, sizeof(highchunk)); 
 53 |         wave_ptr+=sizeof(highchunk);
 54 |     }
 55 | }
 56 | void write0() {
 57 |     printf("0");
 58 |     if(wave_ptr == 0 || wave_buffer[wave_ptr-1] < 128)
 59 |         highChunk(2);
 60 |     else
 61 |         lowChunk(2);
 62 | }
 63 | void write1() {
 64 |     printf("1");
 65 |     if(wave_ptr==0 || wave_buffer[wave_ptr-1] < 128) {
 66 |         highChunk(1);
 67 |         lowChunk(1);
 68 |     }
 69 |     else {
 70 |         lowChunk(1);
 71 |         highChunk(1);
 72 |     }
 73 | }
 74 | void playBit(int writeBit){
 75 |     if (writeBit == 0) 
 76 |         write0();
 77 |     else 
 78 |         write1();
 79 | }
 80 | void playTrack(int track) {
 81 |   int tmp, crc, lrc = 0;
 82 |   track--; // index 0
 83 |   dir = 0;
 84 |   int i, j;
 85 |   // First put out a bunch of leading zeros.
 86 |   for (i = 0; i < 16; i++) 
 87 |       playBit(0);
 88 |   for (i = 0; tracks[track][i] != '\0'; i++){
 89 |     crc = 1;
 90 |     tmp = tracks[track][i] - sublen[track];
 91 |     for (j = 0; j < bitlen[track]-1; j++){
 92 |       crc ^= tmp & 1;
 93 |       lrc ^= (tmp & 1) << j;
 94 |       playBit(tmp & 1);
 95 |       tmp >>= 1;
 96 |     }
 97 |     //printf("-");
 98 |     playBit(crc);
 99 |     //printf("-");
100 |   }
101 |   tmp = lrc;
102 |   crc = 1;
103 |   for (j = 0; j < bitlen[track]-1; j++){
104 |     crc ^= tmp & 1;
105 |     playBit(tmp & 1);
106 |     tmp >>= 1;
107 |   }
108 |   playBit(crc);
109 |   for (i = 0; i < 16; i++)
110 |     playBit(0);
111 | }
112 | 
113 | int main()
114 | {
115 |     lowChunk(30);
116 |     playTrack(1);     
117 |     lowChunk(20);   
118 |     struct riff_chunk myriff;
119 |     struct fmt_chunk myfmt;   
120 |     myriff.chunk_id[0]='R'; 
121 |     myriff.chunk_id[1]='I'; 
122 |     myriff.chunk_id[2]='F'; 
123 |     myriff.chunk_id[3]='F';
124 |     myriff.file_size=wave_ptr+4+4+sizeof(myriff)+sizeof(myfmt);
125 |     myriff.riff_type[0]='W'; 
126 |     myriff.riff_type[1]='A'; 
127 |     myriff.riff_type[2]='V'; 
128 |     myriff.riff_type[3]='E';
129 |     myfmt.chunk_id[0]='f';  
130 |     myfmt.chunk_id[1]='m';  
131 |     myfmt.chunk_id[2]='t'; 
132 |     myfmt.chunk_id[3]=0x20;
133 |     myfmt.chunk_size=0x10;
134 |     myfmt.compression_code=1;
135 |     myfmt.num_channels=1;
136 |     myfmt.sample_rate=8192;
137 |     myfmt.bytes_second=8192;
138 |     myfmt.block_align=1;
139 |     myfmt.bits_sample=8;
140 |     FILE *f=fopen("audiospoof.wav","wb");
141 |     fwrite((void *)&myriff, 1, sizeof(myriff), f);
142 |     fwrite((void *)&myfmt, 1, sizeof(myfmt), f);
143 |     char data_chunk_id[]={ 'd', 'a', 't', 'a' }; fwrite(data_chunk_id, 1, sizeof(data_chunk_id), f);
144 |     fwrite(&wave_ptr, 1, sizeof(wave_ptr), f);
145 |     fwrite(wave_buffer, 1, wave_ptr, f);            
146 |     fclose(f);
147 |     printf("\n");
148 |     return 0;
149 | }
150 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # AudioSpoof
2 | Magnetic stripe spoofer implementing audio waves.</br>
3 | Details: https://salmg.net/2017/01/06/how-to-transmit-mag-stripe-info-through-audio/
4 | 
5 | g++ AudioSpoof.c</br>
6 | ./a.out</br>
7 | play -r 8192 audiospoof.wav repeat 5
8 | 


--------------------------------------------------------------------------------