]> cvs.zerfleddert.de Git - proxmark3-svn/blame - client/cmdlfem4x.c
Applied Holiman's fixes for iclass.c and CSNs
[proxmark3-svn] / client / cmdlfem4x.c
CommitLineData
2ae8a312 1 //-----------------------------------------------------------------------------
a553f267 2// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
3//
4// This code is licensed to you under the terms of the GNU GPL, version 2 or,
5// at your option, any later version. See the LICENSE.txt file for the text of
6// the license.
7//-----------------------------------------------------------------------------
8// Low frequency EM4x commands
9//-----------------------------------------------------------------------------
10
7fe9b0b7 11#include <stdio.h>
9e13f875 12#include <string.h>
ec564290 13#include <inttypes.h>
902cb3c0 14#include "proxmark3.h"
7fe9b0b7 15#include "ui.h"
16#include "graph.h"
f38a1528 17#include "cmdmain.h"
7fe9b0b7 18#include "cmdparser.h"
19#include "cmddata.h"
20#include "cmdlf.h"
21#include "cmdlfem4x.h"
f38a1528 22#include "util.h"
23#include "data.h"
f6c18637 24#define LF_TRACE_BUFF_SIZE 12000
c6be64da 25#define LF_BITSSTREAM_LEN 1000
f38a1528 26
27char *global_em410xId;
7fe9b0b7 28
29static int CmdHelp(const char *Cmd);
30
31/* Read the ID of an EM410x tag.
32 * Format:
33 * 1111 1111 1 <-- standard non-repeatable header
34 * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
35 * ....
36 * CCCC <-- each bit here is parity for the 10 bits above in corresponding column
37 * 0 <-- stop bit, end of tag
38 */
39int CmdEM410xRead(const char *Cmd)
40{
41 int i, j, clock, header, rows, bit, hithigh, hitlow, first, bit2idx, high, low;
42 int parity[4];
43 char id[11];
080ff30a 44 char id2[11];
7fe9b0b7 45 int retested = 0;
15cdabd4 46 uint8_t BitStream[MAX_GRAPH_TRACE_LEN];
7fe9b0b7 47 high = low = 0;
48
49 /* Detect high and lows and clock */
50 for (i = 0; i < GraphTraceLen; i++)
51 {
52 if (GraphBuffer[i] > high)
53 high = GraphBuffer[i];
54 else if (GraphBuffer[i] < low)
55 low = GraphBuffer[i];
56 }
57
58 /* get clock */
59 clock = GetClock(Cmd, high, 0);
3649b640 60
7fe9b0b7 61 /* parity for our 4 columns */
62 parity[0] = parity[1] = parity[2] = parity[3] = 0;
63 header = rows = 0;
64
65 /* manchester demodulate */
66 bit = bit2idx = 0;
67 for (i = 0; i < (int)(GraphTraceLen / clock); i++)
68 {
69 hithigh = 0;
70 hitlow = 0;
71 first = 1;
72
73 /* Find out if we hit both high and low peaks */
74 for (j = 0; j < clock; j++)
75 {
76 if (GraphBuffer[(i * clock) + j] == high)
77 hithigh = 1;
78 else if (GraphBuffer[(i * clock) + j] == low)
79 hitlow = 1;
80
81 /* it doesn't count if it's the first part of our read
82 because it's really just trailing from the last sequence */
83 if (first && (hithigh || hitlow))
84 hithigh = hitlow = 0;
85 else
86 first = 0;
87
88 if (hithigh && hitlow)
89 break;
90 }
91
92 /* If we didn't hit both high and low peaks, we had a bit transition */
93 if (!hithigh || !hitlow)
94 bit ^= 1;
95
96 BitStream[bit2idx++] = bit;
97 }
98
99retest:
100 /* We go till 5 before the graph ends because we'll get that far below */
3649b640 101 for (i = 0; i < bit2idx - 5; i++)
7fe9b0b7 102 {
103 /* Step 2: We have our header but need our tag ID */
104 if (header == 9 && rows < 10)
105 {
106 /* Confirm parity is correct */
107 if ((BitStream[i] ^ BitStream[i+1] ^ BitStream[i+2] ^ BitStream[i+3]) == BitStream[i+4])
108 {
109 /* Read another byte! */
110 sprintf(id+rows, "%x", (8 * BitStream[i]) + (4 * BitStream[i+1]) + (2 * BitStream[i+2]) + (1 * BitStream[i+3]));
cb967ea9 111 sprintf(id2+rows, "%x", (8 * BitStream[i+3]) + (4 * BitStream[i+2]) + (2 * BitStream[i+1]) + (1 * BitStream[i]));
7fe9b0b7 112 rows++;
113
114 /* Keep parity info */
115 parity[0] ^= BitStream[i];
116 parity[1] ^= BitStream[i+1];
117 parity[2] ^= BitStream[i+2];
118 parity[3] ^= BitStream[i+3];
119
120 /* Move 4 bits ahead */
121 i += 4;
122 }
123
124 /* Damn, something wrong! reset */
125 else
126 {
127 PrintAndLog("Thought we had a valid tag but failed at word %d (i=%d)", rows + 1, i);
128
129 /* Start back rows * 5 + 9 header bits, -1 to not start at same place */
c15d2bdc 130 i -= 9 + (5 * rows) -5;
7fe9b0b7 131
132 rows = header = 0;
133 }
134 }
135
136 /* Step 3: Got our 40 bits! confirm column parity */
137 else if (rows == 10)
138 {
139 /* We need to make sure our 4 bits of parity are correct and we have a stop bit */
140 if (BitStream[i] == parity[0] && BitStream[i+1] == parity[1] &&
141 BitStream[i+2] == parity[2] && BitStream[i+3] == parity[3] &&
142 BitStream[i+4] == 0)
143 {
144 /* Sweet! */
145 PrintAndLog("EM410x Tag ID: %s", id);
cb967ea9 146 PrintAndLog("Unique Tag ID: %s", id2);
7fe9b0b7 147
f38a1528 148 global_em410xId = id;
149
7fe9b0b7 150 /* Stop any loops */
151 return 1;
152 }
153
154 /* Crap! Incorrect parity or no stop bit, start all over */
155 else
156 {
157 rows = header = 0;
158
159 /* Go back 59 bits (9 header bits + 10 rows at 4+1 parity) */
160 i -= 59;
161 }
162 }
163
164 /* Step 1: get our header */
165 else if (header < 9)
166 {
167 /* Need 9 consecutive 1's */
168 if (BitStream[i] == 1)
169 header++;
170
171 /* We don't have a header, not enough consecutive 1 bits */
172 else
173 header = 0;
174 }
175 }
176
177 /* if we've already retested after flipping bits, return */
f38a1528 178 if (retested++){
7fe9b0b7 179 return 0;
f38a1528 180 }
7fe9b0b7 181
182 /* if this didn't work, try flipping bits */
183 for (i = 0; i < bit2idx; i++)
184 BitStream[i] ^= 1;
185
186 goto retest;
187}
188
189/* emulate an EM410X tag
190 * Format:
191 * 1111 1111 1 <-- standard non-repeatable header
192 * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
193 * ....
194 * CCCC <-- each bit here is parity for the 10 bits above in corresponding column
195 * 0 <-- stop bit, end of tag
196 */
197int CmdEM410xSim(const char *Cmd)
2ae8a312 198{
06b58a94 199 int i, n, j, binary[4], parity[4];
2ae8a312 200
201 char cmdp = param_getchar(Cmd, 0);
202 uint8_t uid[5] = {0x00};
203
204 if (cmdp == 'h' || cmdp == 'H') {
a501c82b 205 PrintAndLog("Usage: lf em4x 410xsim <UID>");
2ae8a312 206 PrintAndLog("");
a501c82b 207 PrintAndLog(" sample: lf em4x 410xsim 0F0368568B");
2ae8a312 208 return 0;
209 }
7fe9b0b7 210
2ae8a312 211 if (param_gethex(Cmd, 0, uid, 10)) {
212 PrintAndLog("UID must include 10 HEX symbols");
213 return 0;
214 }
215
3649b640 216 PrintAndLog("Starting simulating UID %02X%02X%02X%02X%02X", uid[0],uid[1],uid[2],uid[3],uid[4]);
217 PrintAndLog("Press pm3-button to about simulation");
2ae8a312 218
7fe9b0b7 219 /* clock is 64 in EM410x tags */
220 int clock = 64;
221
222 /* clear our graph */
c15d2bdc 223 ClearGraph(0);
7c756d68 224
7fe9b0b7 225 /* write 9 start bits */
226 for (i = 0; i < 9; i++)
227 AppendGraph(0, clock, 1);
228
229 /* for each hex char */
230 parity[0] = parity[1] = parity[2] = parity[3] = 0;
231 for (i = 0; i < 10; i++)
232 {
233 /* read each hex char */
234 sscanf(&Cmd[i], "%1x", &n);
235 for (j = 3; j >= 0; j--, n/= 2)
236 binary[j] = n % 2;
237
238 /* append each bit */
239 AppendGraph(0, clock, binary[0]);
240 AppendGraph(0, clock, binary[1]);
241 AppendGraph(0, clock, binary[2]);
242 AppendGraph(0, clock, binary[3]);
243
244 /* append parity bit */
245 AppendGraph(0, clock, binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
246
247 /* keep track of column parity */
248 parity[0] ^= binary[0];
249 parity[1] ^= binary[1];
250 parity[2] ^= binary[2];
251 parity[3] ^= binary[3];
252 }
253
254 /* parity columns */
255 AppendGraph(0, clock, parity[0]);
256 AppendGraph(0, clock, parity[1]);
257 AppendGraph(0, clock, parity[2]);
258 AppendGraph(0, clock, parity[3]);
259
06b58a94 260 /* stop bit */
a501c82b 261 AppendGraph(1, clock, 0);
06b58a94 262
a501c82b 263 CmdLFSim("240"); //240 start_gap.
7fe9b0b7 264 return 0;
265}
266
c2d25819 267/* Function is equivalent of lf read + data samples + em410xread
268 * looped until an EM410x tag is detected
269 *
270 * Why is CmdSamples("16000")?
271 * TBD: Auto-grow sample size based on detected sample rate. IE: If the
272 * rate gets lower, then grow the number of samples
273 * Changed by martin, 4000 x 4 = 16000,
274 * see http://www.proxmark.org/forum/viewtopic.php?pid=7235#p7235
275
276*/
7fe9b0b7 277int CmdEM410xWatch(const char *Cmd)
278{
c2d25819 279 int read_h = (*Cmd == 'h');
280 do
281 {
2ae8a312 282 if (ukbhit()) {
283 printf("\naborted via keyboard!\n");
284 break;
285 }
286
c2d25819 287 CmdLFRead(read_h ? "h" : "");
c15d2bdc 288 CmdSamples("6000");
2ae8a312 289
c2d25819 290 } while (
a61b4976 291 !CmdEM410xRead("")
f38a1528 292 );
c2d25819 293 return 0;
f38a1528 294}
295
296int CmdEM410xWatchnSpoof(const char *Cmd)
297{
c2d25819 298 CmdEM410xWatch(Cmd);
f38a1528 299 PrintAndLog("# Replaying : %s",global_em410xId);
300 CmdEM410xSim(global_em410xId);
7fe9b0b7 301 return 0;
302}
303
304/* Read the transmitted data of an EM4x50 tag
305 * Format:
306 *
307 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
308 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
309 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
310 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
311 * CCCCCCCC <- column parity bits
312 * 0 <- stop bit
313 * LW <- Listen Window
314 *
315 * This pattern repeats for every block of data being transmitted.
316 * Transmission starts with two Listen Windows (LW - a modulated
317 * pattern of 320 cycles each (32/32/128/64/64)).
318 *
319 * Note that this data may or may not be the UID. It is whatever data
320 * is stored in the blocks defined in the control word First and Last
321 * Word Read values. UID is stored in block 32.
322 */
323int CmdEM4x50Read(const char *Cmd)
324{
31b6e9af 325 int i, j, startblock, skip, block, start, end, low, high;
7fe9b0b7 326 bool complete= false;
327 int tmpbuff[MAX_GRAPH_TRACE_LEN / 64];
328 char tmp[6];
329
330 high= low= 0;
913d23c6 331 memset(tmpbuff, 0, MAX_GRAPH_TRACE_LEN / 64);
7fe9b0b7 332
333 /* first get high and low values */
334 for (i = 0; i < GraphTraceLen; i++)
335 {
336 if (GraphBuffer[i] > high)
337 high = GraphBuffer[i];
338 else if (GraphBuffer[i] < low)
339 low = GraphBuffer[i];
340 }
341
342 /* populate a buffer with pulse lengths */
343 i= 0;
344 j= 0;
345 while (i < GraphTraceLen)
346 {
347 // measure from low to low
348 while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
349 ++i;
350 start= i;
351 while ((GraphBuffer[i] < high) && (i<GraphTraceLen))
352 ++i;
353 while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
354 ++i;
a61b4976 355 if (j>=(MAX_GRAPH_TRACE_LEN/64)) {
7fe9b0b7 356 break;
357 }
358 tmpbuff[j++]= i - start;
359 }
360
361 /* look for data start - should be 2 pairs of LW (pulses of 192,128) */
362 start= -1;
363 skip= 0;
364 for (i= 0; i < j - 4 ; ++i)
365 {
366 skip += tmpbuff[i];
367 if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
368 if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
369 if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
370 if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
371 {
372 start= i + 3;
373 break;
374 }
375 }
376 startblock= i + 3;
377
378 /* skip over the remainder of the LW */
379 skip += tmpbuff[i+1]+tmpbuff[i+2];
380 while (skip < MAX_GRAPH_TRACE_LEN && GraphBuffer[skip] > low)
381 ++skip;
382 skip += 8;
383
384 /* now do it again to find the end */
385 end= start;
386 for (i += 3; i < j - 4 ; ++i)
387 {
388 end += tmpbuff[i];
389 if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
390 if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
391 if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
392 if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
393 {
394 complete= true;
395 break;
396 }
397 }
398
399 if (start >= 0)
400 PrintAndLog("Found data at sample: %i",skip);
401 else
402 {
403 PrintAndLog("No data found!");
404 PrintAndLog("Try again with more samples.");
405 return 0;
406 }
407
408 if (!complete)
409 {
410 PrintAndLog("*** Warning!");
411 PrintAndLog("Partial data - no end found!");
412 PrintAndLog("Try again with more samples.");
413 }
414
415 /* get rid of leading crap */
416 sprintf(tmp,"%i",skip);
417 CmdLtrim(tmp);
418
419 /* now work through remaining buffer printing out data blocks */
420 block= 0;
421 i= startblock;
422 while (block < 6)
423 {
424 PrintAndLog("Block %i:", block);
425 // mandemod routine needs to be split so we can call it for data
426 // just print for now for debugging
427 CmdManchesterDemod("i 64");
428 skip= 0;
429 /* look for LW before start of next block */
430 for ( ; i < j - 4 ; ++i)
431 {
432 skip += tmpbuff[i];
433 if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
434 if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
435 break;
436 }
437 while (GraphBuffer[skip] > low)
438 ++skip;
439 skip += 8;
440 sprintf(tmp,"%i",skip);
441 CmdLtrim(tmp);
442 start += skip;
443 block++;
444 }
445 return 0;
446}
447
2d4eae76 448int CmdEM410xWrite(const char *Cmd)
449{
e67b06b7 450 uint64_t id = 0xFFFFFFFFFFFFFFFF; // invalid id value
7bb9d33e 451 int card = 0xFF; // invalid card value
e67b06b7 452 unsigned int clock = 0; // invalid clock value
453
454 sscanf(Cmd, "%" PRIx64 " %d %d", &id, &card, &clock);
455
456 // Check ID
457 if (id == 0xFFFFFFFFFFFFFFFF) {
458 PrintAndLog("Error! ID is required.\n");
459 return 0;
460 }
461 if (id >= 0x10000000000) {
462 PrintAndLog("Error! Given EM410x ID is longer than 40 bits.\n");
463 return 0;
464 }
465
466 // Check Card
467 if (card == 0xFF) {
468 PrintAndLog("Error! Card type required.\n");
469 return 0;
470 }
471 if (card < 0) {
472 PrintAndLog("Error! Bad card type selected.\n");
473 return 0;
474 }
475
476 // Check Clock
477 if (card == 1)
478 {
479 // Default: 64
480 if (clock == 0)
481 clock = 64;
482
483 // Allowed clock rates: 16, 32 and 64
484 if ((clock != 16) && (clock != 32) && (clock != 64)) {
485 PrintAndLog("Error! Clock rate %d not valid. Supported clock rates are 16, 32 and 64.\n", clock);
486 return 0;
487 }
488 }
489 else if (clock != 0)
490 {
491 PrintAndLog("Error! Clock rate is only supported on T55x7 tags.\n");
492 return 0;
493 }
494
495 if (card == 1) {
496 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64 " (clock rate: %d)", "T55x7", id, clock);
497 // NOTE: We really should pass the clock in as a separate argument, but to
498 // provide for backwards-compatibility for older firmware, and to avoid
499 // having to add another argument to CMD_EM410X_WRITE_TAG, we just store
500 // the clock rate in bits 8-15 of the card value
501 card = (card & 0xFF) | (((uint64_t)clock << 8) & 0xFF00);
502 }
503 else if (card == 0)
504 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64, "T5555", id, clock);
505 else {
506 PrintAndLog("Error! Bad card type selected.\n");
507 return 0;
508 }
2d4eae76 509
2d4eae76 510 UsbCommand c = {CMD_EM410X_WRITE_TAG, {card, (uint32_t)(id >> 32), (uint32_t)id}};
511 SendCommand(&c);
512
513 return 0;
514}
515
54a942b0 516int CmdReadWord(const char *Cmd)
517{
f38a1528 518 int Word = -1; //default to invalid word
b44e5233 519 UsbCommand c;
54a942b0 520
b44e5233 521 sscanf(Cmd, "%d", &Word);
54a942b0 522
f38a1528 523 if ( (Word > 15) | (Word < 0) ) {
b44e5233 524 PrintAndLog("Word must be between 0 and 15");
525 return 1;
526 }
54a942b0 527
b44e5233 528 PrintAndLog("Reading word %d", Word);
54a942b0 529
b44e5233 530 c.cmd = CMD_EM4X_READ_WORD;
531 c.d.asBytes[0] = 0x0; //Normal mode
532 c.arg[0] = 0;
533 c.arg[1] = Word;
534 c.arg[2] = 0;
535 SendCommand(&c);
f38a1528 536 WaitForResponse(CMD_ACK, NULL);
537
f6c18637 538 uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
f38a1528 539
b44e5233 540 GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560); //3560 -- should be offset..
f38a1528 541 WaitForResponseTimeout(CMD_ACK,NULL, 1500);
542
b44e5233 543 for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
f6c18637 544 GraphBuffer[j] = ((int)data[j]);
f38a1528 545 }
b44e5233 546 GraphTraceLen = LF_TRACE_BUFF_SIZE;
b44e5233 547
c6be64da 548 uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
b44e5233 549 uint8_t * bitstream = bits;
c6be64da 550 manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream,LF_BITSSTREAM_LEN);
f6c18637 551 RepaintGraphWindow();
54a942b0 552 return 0;
553}
554
555int CmdReadWordPWD(const char *Cmd)
556{
f38a1528 557 int Word = -1; //default to invalid word
b44e5233 558 int Password = 0xFFFFFFFF; //default to blank password
559 UsbCommand c;
560
561 sscanf(Cmd, "%d %x", &Word, &Password);
562
f38a1528 563 if ( (Word > 15) | (Word < 0) ) {
b44e5233 564 PrintAndLog("Word must be between 0 and 15");
565 return 1;
566 }
54a942b0 567
b44e5233 568 PrintAndLog("Reading word %d with password %08X", Word, Password);
569
570 c.cmd = CMD_EM4X_READ_WORD;
571 c.d.asBytes[0] = 0x1; //Password mode
572 c.arg[0] = 0;
573 c.arg[1] = Word;
574 c.arg[2] = Password;
575 SendCommand(&c);
f38a1528 576 WaitForResponse(CMD_ACK, NULL);
b44e5233 577
f6c18637 578 uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
f38a1528 579
b44e5233 580 GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560); //3560 -- should be offset..
f38a1528 581 WaitForResponseTimeout(CMD_ACK,NULL, 1500);
582
b44e5233 583 for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
f6c18637 584 GraphBuffer[j] = ((int)data[j]);
f38a1528 585 }
b44e5233 586 GraphTraceLen = LF_TRACE_BUFF_SIZE;
b44e5233 587
c6be64da 588 uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
589 uint8_t * bitstream = bits;
590 manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream, LF_BITSSTREAM_LEN);
f6c18637 591 RepaintGraphWindow();
54a942b0 592 return 0;
593}
594
595int CmdWriteWord(const char *Cmd)
596{
597 int Word = 16; //default to invalid block
598 int Data = 0xFFFFFFFF; //default to blank data
599 UsbCommand c;
600
601 sscanf(Cmd, "%x %d", &Data, &Word);
602
603 if (Word > 15) {
604 PrintAndLog("Word must be between 0 and 15");
605 return 1;
606 }
607
a61b4976 608 PrintAndLog("Writing word %d with data %08X", Word, Data);
54a942b0 609
610 c.cmd = CMD_EM4X_WRITE_WORD;
611 c.d.asBytes[0] = 0x0; //Normal mode
612 c.arg[0] = Data;
613 c.arg[1] = Word;
614 c.arg[2] = 0;
615 SendCommand(&c);
616 return 0;
617}
618
619int CmdWriteWordPWD(const char *Cmd)
620{
a61b4976 621 int Word = 16; //default to invalid word
54a942b0 622 int Data = 0xFFFFFFFF; //default to blank data
623 int Password = 0xFFFFFFFF; //default to blank password
624 UsbCommand c;
625
626 sscanf(Cmd, "%x %d %x", &Data, &Word, &Password);
627
628 if (Word > 15) {
629 PrintAndLog("Word must be between 0 and 15");
630 return 1;
631 }
632
a61b4976 633 PrintAndLog("Writing word %d with data %08X and password %08X", Word, Data, Password);
54a942b0 634
635 c.cmd = CMD_EM4X_WRITE_WORD;
636 c.d.asBytes[0] = 0x1; //Password mode
637 c.arg[0] = Data;
638 c.arg[1] = Word;
639 c.arg[2] = Password;
640 SendCommand(&c);
641 return 0;
642}
643
2d4eae76 644static command_t CommandTable[] =
7fe9b0b7 645{
54a942b0 646 {"help", CmdHelp, 1, "This help"},
c15d2bdc 647
c2d25819 648 {"410xread", CmdEM410xRead, 1, "[clock rate] -- Extract ID from EM410x tag"},
649 {"410xsim", CmdEM410xSim, 0, "<UID> -- Simulate EM410x tag"},
c15d2bdc 650 {"replay", MWRem4xReplay, 0, "Watches for tag and simulates manchester encoded em4x tag"},
c2d25819 651 {"410xwatch", CmdEM410xWatch, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"},
652 {"410xspoof", CmdEM410xWatchnSpoof, 0, "['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)" },
653 {"410xwrite", CmdEM410xWrite, 1, "<UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"},
654 {"4x50read", CmdEM4x50Read, 1, "Extract data from EM4x50 tag"},
f38a1528 655 {"rd", CmdReadWord, 1, "<Word 1-15> -- Read EM4xxx word data"},
656 {"rdpwd", CmdReadWordPWD, 1, "<Word 1-15> <Password> -- Read EM4xxx word data in password mode "},
657 {"wr", CmdWriteWord, 1, "<Data> <Word 1-15> -- Write EM4xxx word data"},
658 {"wrpwd", CmdWriteWordPWD, 1, "<Data> <Word 1-15> <Password> -- Write EM4xxx word data in password mode"},
7fe9b0b7 659 {NULL, NULL, 0, NULL}
660};
661
c15d2bdc 662
663//Confirms the parity of a bitstream as well as obtaining the data (TagID) from within the appropriate memory space.
664//Arguments:
665// Pointer to a string containing the desired bitsream
666// Pointer to a string that will receive the decoded tag ID
667// Length of the bitsream pointed at in the first argument, char* _strBitStream
668//Retuns:
669//1 Parity confirmed
670//0 Parity not confirmed
671int ConfirmEm410xTagParity( char* _strBitStream, char* pID, int LengthOfBitstream )
672{
673 int i = 0;
674 int rows = 0;
675 int Parity[4] = {0x00};
676 char ID[11] = {0x00};
677 int k = 0;
678 int BitStream[70] = {0x00};
679 int counter = 0;
680 //prepare variables
681 for ( i = 0; i <= LengthOfBitstream; i++)
682 {
683 if (_strBitStream[i] == '1')
684 {
685 k =1;
686 memcpy(&BitStream[i], &k,4);
687 }
688 else if (_strBitStream[i] == '0')
689 {
690 k = 0;
691 memcpy(&BitStream[i], &k,4);
692 }
693 }
694 while ( counter < 2 )
695 {
696 //set/reset variables and counters
697 memset(ID,0x00,sizeof(ID));
698 memset(Parity,0x00,sizeof(Parity));
699 rows = 0;
700 for ( i = 9; i <= LengthOfBitstream; i++)
701 {
702 if ( rows < 10 )
703 {
704 if ((BitStream[i] ^ BitStream[i+1] ^ BitStream[i+2] ^ BitStream[i+3]) == BitStream[i+4])
705 {
706 sprintf(ID+rows, "%x", (8 * BitStream[i]) + (4 * BitStream[i+1]) + (2 * BitStream[i+2]) + (1 * BitStream[i+3]));
707 rows++;
708 /* Keep parity info and move four bits ahead*/
709 Parity[0] ^= BitStream[i];
710 Parity[1] ^= BitStream[i+1];
711 Parity[2] ^= BitStream[i+2];
712 Parity[3] ^= BitStream[i+3];
713 i += 4;
714 }
715 }
716 if ( rows == 10 )
717 {
718 if ( BitStream[i] == Parity[0] && BitStream[i+1] == Parity[1] &&
719 BitStream[i+2] == Parity[2] && BitStream[i+3] == Parity[3] &&
720 BitStream[i+4] == 0)
721 {
722 memcpy(pID,ID,strlen(ID));
723 return 1;
724 }
725 }
726 }
727 printf("[PARITY ->]Failed. Flipping Bits, and rechecking parity for bitstream:\n[PARITY ->]");
728 for (k = 0; k < LengthOfBitstream; k++)
729 {
730 BitStream[k] ^= 1;
731 printf("%i", BitStream[k]);
732 }
733 puts(" ");
734 counter++;
735 }
736 return 0;
737}
738//Reads and demodulates an em410x RFID tag. It further allows slight modification to the decoded bitstream
739//Once a suitable bitstream has been identified, and if needed, modified, it is replayed. Allowing emulation of the
740//"stolen" rfid tag.
741//No meaningful returns or arguments.
742int MWRem4xReplay(const char* Cmd)
743{
744 // //header traces
745 // static char ArrayTraceZero[] = { '0','0','0','0','0','0','0','0','0' };
746 // static char ArrayTraceOne[] = { '1','1','1','1','1','1','1','1','1' };
747 // //local string variables
748 // char strClockRate[10] = {0x00};
749 // char strAnswer[4] = {0x00};
750 // char strTempBufferMini[2] = {0x00};
751 // //our outbound bit-stream
752 // char strSimulateBitStream[65] = {0x00};
753 // //integers
754 // int iClockRate = 0;
755 // int needle = 0;
756 // int j = 0;
757 // int iFirstHeaderOffset = 0x00000000;
758 // int numManchesterDemodBits=0;
759 // //boolean values
760 // bool bInverted = false;
761 // //pointers to strings. memory will be allocated.
762 // char* pstrInvertBitStream = 0x00000000;
763 // char* pTempBuffer = 0x00000000;
764 // char* pID = 0x00000000;
765 // char* strBitStreamBuffer = 0x00000000;
766
767
768 // puts("###################################");
769 // puts("#### Em4x Replay ##");
770 // puts("#### R.A.M. June 2013 ##");
771 // puts("###################################");
772 // //initialize
773 // CmdLFRead("");
774 // //Collect ourselves 10,000 samples
775 // CmdSamples("10000");
776 // puts("[->]preforming ASK demodulation\n");
777 // //demodulate ask
778 // Cmdaskdemod("0");
779 // iClockRate = DetectClock(0);
780 // sprintf(strClockRate, "%i\n",iClockRate);
781 // printf("[->]Detected ClockRate: %s\n", strClockRate);
782
783 // //If detected clock rate is something completely unreasonable, dont go ahead
784 // if ( iClockRate < 0xFFFE )
785 // {
786 // pTempBuffer = (char*)malloc(MAX_GRAPH_TRACE_LEN);
787 // if (pTempBuffer == 0x00000000)
788 // return 0;
789 // memset(pTempBuffer,0x00,MAX_GRAPH_TRACE_LEN);
790 // //Preform manchester de-modulation and display in a single line.
791 // numManchesterDemodBits = CmdManchesterDemod( strClockRate );
792 // //note: numManchesterDemodBits is set above in CmdManchesterDemod()
793 // if ( numManchesterDemodBits == 0 )
794 // return 0;
795 // strBitStreamBuffer = malloc(numManchesterDemodBits+1);
796 // if ( strBitStreamBuffer == 0x00000000 )
797 // return 0;
798 // memset(strBitStreamBuffer, 0x00, (numManchesterDemodBits+1));
799 // //fill strBitStreamBuffer with demodulated, string formatted bits.
800 // for ( j = 0; j <= numManchesterDemodBits; j++ )
801 // {
802 // sprintf(strTempBufferMini, "%i",BitStream[j]);
803 // strcat(strBitStreamBuffer,strTempBufferMini);
804 // }
805 // printf("[->]Demodulated Bitstream: \n%s\n", strBitStreamBuffer);
806 // //Reset counter and select most probable bit stream
807 // j = 0;
808 // while ( j < numManchesterDemodBits )
809 // {
810 // memset(strSimulateBitStream,0x00,64);
811 // //search for header of nine (9) 0's : 000000000 or nine (9) 1's : 1111 1111 1
812 // if ( ( strncmp(strBitStreamBuffer+j, ArrayTraceZero, sizeof(ArrayTraceZero)) == 0 ) ||
813 // ( strncmp(strBitStreamBuffer+j, ArrayTraceOne, sizeof(ArrayTraceOne)) == 0 ) )
814 // {
815 // iFirstHeaderOffset = j;
816 // memcpy(strSimulateBitStream, strBitStreamBuffer+j,64);
817 // printf("[->]Offset of Header");
818 // if ( strncmp(strBitStreamBuffer+iFirstHeaderOffset, "0", 1) == 0 )
819 // printf("'%s'", ArrayTraceZero );
820 // else
821 // printf("'%s'", ArrayTraceOne );
822 // printf(": %i\nHighlighted string : %s\n",iFirstHeaderOffset,strSimulateBitStream);
823 // //allow us to escape loop or choose another frame
824 // puts("[<-]Are we happy with this sample? [Y]es/[N]o");
825 // gets(strAnswer);
826 // if ( ( strncmp(strAnswer,"y",1) == 0 ) || ( strncmp(strAnswer,"Y",1) == 0 ) )
827 // {
828 // j = numManchesterDemodBits+1;
829 // break;
830 // }
831 // }
832 // j++;
833 // }
834 // }
835 // else return 0;
836
837 // //Do we want the buffer inverted?
838 // memset(strAnswer, 0x00, sizeof(strAnswer));
839 // printf("[<-]Do you wish to invert the highlighted bitstream? [Y]es/[N]o\n");
840 // gets(strAnswer);
841 // if ( ( strncmp("y", strAnswer,1) == 0 ) || ( strncmp("Y", strAnswer, 1 ) == 0 ) )
842 // {
843 // //allocate heap memory
844 // pstrInvertBitStream = (char*)malloc(numManchesterDemodBits);
845 // if ( pstrInvertBitStream != 0x00000000 )
846 // {
847 // memset(pstrInvertBitStream,0x00,numManchesterDemodBits);
848 // bInverted = true;
849 // //Invert Bitstream
850 // for ( needle = 0; needle <= numManchesterDemodBits; needle++ )
851 // {
852 // if (strSimulateBitStream[needle] == '0')
853 // strcat(pstrInvertBitStream,"1");
854 // else if (strSimulateBitStream[needle] == '1')
855 // strcat(pstrInvertBitStream,"0");
856 // }
857 // printf("[->]Inverted bitstream: %s\n", pstrInvertBitStream);
858 // }
859 // }
860 // //Confirm parity of selected string
861 // pID = (char*)malloc(11);
862 // if (pID != 0x00000000)
863 // {
864 // memset(pID, 0x00, 11);
865 // if (ConfirmEm410xTagParity(strSimulateBitStream,pID, 64) == 1)
866 // {
867 // printf("[->]Parity confirmed for selected bitstream!\n");
868 // printf("[->]Tag ID was detected as: [hex]:%s\n",pID );
869 // }
870 // else
871 // printf("[->]Parity check failed for the selected bitstream!\n");
872 // }
873
874 // //Spoof
875 // memset(strAnswer, 0x00, sizeof(strAnswer));
876 // printf("[<-]Do you wish to continue with the EM4x simulation? [Y]es/[N]o\n");
877 // gets(strAnswer);
878 // if ( ( strncmp(strAnswer,"y",1) == 0 ) || ( strncmp(strAnswer,"Y",1) == 0 ) )
879 // {
880 // strcat(pTempBuffer, strClockRate);
881 // strcat(pTempBuffer, " ");
882 // if (bInverted == true)
883 // strcat(pTempBuffer,pstrInvertBitStream);
884 // if (bInverted == false)
885 // strcat(pTempBuffer,strSimulateBitStream);
886 // //inform the user
887 // puts("[->]Starting simulation now: \n");
888 // //Simulate tag with prepared buffer.
889 // CmdLFSimManchester(pTempBuffer);
890 // }
891 // else if ( ( strcmp("n", strAnswer) == 0 ) || ( strcmp("N", strAnswer ) == 0 ) )
892 // printf("[->]Exiting procedure now...\n");
893 // else
894 // printf("[->]Erroneous selection\nExiting procedure now....\n");
895
896 // //Clean up -- Exit function
897 // //clear memory, then release pointer.
898 // if ( pstrInvertBitStream != 0x00000000 )
899 // {
900 // memset(pstrInvertBitStream,0x00,numManchesterDemodBits);
901 // free(pstrInvertBitStream);
902 // }
903 // if ( pTempBuffer != 0x00000000 )
904 // {
905 // memset(pTempBuffer,0x00,MAX_GRAPH_TRACE_LEN);
906 // free(pTempBuffer);
907 // }
908 // if ( pID != 0x00000000 )
909 // {
910 // memset(pID,0x00,11);
911 // free(pID);
912 // }
913 // if ( strBitStreamBuffer != 0x00000000 )
914 // {
915 // memset(strBitStreamBuffer,0x00,numManchesterDemodBits);
916 // free(strBitStreamBuffer);
917 // }
918 return 0;
919}
920
7fe9b0b7 921int CmdLFEM4X(const char *Cmd)
922{
923 CmdsParse(CommandTable, Cmd);
924 return 0;
925}
926
927int CmdHelp(const char *Cmd)
928{
929 CmdsHelp(CommandTable);
930 return 0;
931}
Impressum, Datenschutz