cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfem4x.c

   1  //-----------------------------------------------------------------------------
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // Low frequency EM4x commands
   9 //-----------------------------------------------------------------------------
  10
  11 #include <stdio.h>
  12 #include <string.h>
  13 #include <inttypes.h>
  14 #include "proxmark3.h"
  15 #include "ui.h"
  16 #include "graph.h"
  17 #include "cmdmain.h"
  18 #include "cmdparser.h"
  19 #include "cmddata.h"
  20 #include "cmdlf.h"
  21 #include "cmdlfem4x.h"
  22 #include "util.h"
  23 #include "data.h"
  24 #define LF_TRACE_BUFF_SIZE 12000
  25 #define LF_BITSSTREAM_LEN 1000
  26
  27 char *global_em410xId;
  28
  29 static int CmdHelp(const char *Cmd);
  30
  31 int CmdEMdemodASK(const char *Cmd)
  32 {
  33         char cmdp = param_getchar(Cmd, 0);
  34         int findone = (cmdp == '1') ? 1 : 0;
  35         UsbCommand c = { CMD_EM410X_DEMOD };
  36         c.arg[0] = findone;
  37         SendCommand(&c);
  38         return 0;
  39 }
  40
  41 /* Read the ID of an EM410x tag.
  42  * Format:
  43  *   1111 1111 1           <-- standard non-repeatable header
  44  *   XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
  45  *   ....
  46  *   CCCC                  <-- each bit here is parity for the 10 bits above in corresponding column
  47  *   0                     <-- stop bit, end of tag
  48  */
  49 int CmdEM410xRead(const char *Cmd)
  50 {
  51   int i, j, clock, header, rows, bit, hithigh, hitlow, first, bit2idx, high, low;
  52   int parity[4];
  53   char id[11] = {0x00};
  54   char id2[11] = {0x00};
  55   int retested = 0;
  56   uint8_t BitStream[MAX_GRAPH_TRACE_LEN];
  57   high = low = 0;
  58
  59   // get clock
  60   clock = GetClock(Cmd, 0);
  61
  62   // Detect high and lows and clock
  63   DetectHighLowInGraph( &high, &low, TRUE);
  64
  65   PrintAndLog("NUMNUM");
  66
  67   // parity for our 4 columns
  68   parity[0] = parity[1] = parity[2] = parity[3] = 0;
  69   header = rows = 0;
  70
  71   // manchester demodulate
  72   bit = bit2idx = 0;
  73   for (i = 0; i < (int)(GraphTraceLen / clock); i++)
  74   {
  75     hithigh = 0;
  76     hitlow = 0;
  77     first = 1;
  78
  79     /* Find out if we hit both high and low peaks */
  80     for (j = 0; j < clock; j++)
  81     {
  82       if (GraphBuffer[(i * clock) + j] >= high)
  83         hithigh = 1;
  84       else if (GraphBuffer[(i * clock) + j] <= low)
  85         hitlow = 1;
  86
  87       /* it doesn't count if it's the first part of our read
  88        because it's really just trailing from the last sequence */
  89       if (first && (hithigh || hitlow))
  90         hithigh = hitlow = 0;
  91       else
  92         first = 0;
  93
  94       if (hithigh && hitlow)
  95         break;
  96     }
  97
  98     /* If we didn't hit both high and low peaks, we had a bit transition */
  99     if (!hithigh || !hitlow)
 100       bit ^= 1;
 101
 102     BitStream[bit2idx++] = bit;
 103   }
 104
 105 retest:
 106   /* We go till 5 before the graph ends because we'll get that far below */
 107   for (i = 0; i < bit2idx - 5; i++)
 108   {
 109     /* Step 2: We have our header but need our tag ID */
 110     if (header == 9 && rows < 10)
 111     {
 112       /* Confirm parity is correct */
 113       if ((BitStream[i] ^ BitStream[i+1] ^ BitStream[i+2] ^ BitStream[i+3]) == BitStream[i+4])
 114       {
 115         /* Read another byte! */
 116         sprintf(id+rows, "%x", (8 * BitStream[i]) + (4 * BitStream[i+1]) + (2 * BitStream[i+2]) + (1 * BitStream[i+3]));
 117         sprintf(id2+rows, "%x", (8 * BitStream[i+3]) + (4 * BitStream[i+2]) + (2 * BitStream[i+1]) + (1 * BitStream[i]));
 118         rows++;
 119
 120         /* Keep parity info */
 121         parity[0] ^= BitStream[i];
 122         parity[1] ^= BitStream[i+1];
 123         parity[2] ^= BitStream[i+2];
 124         parity[3] ^= BitStream[i+3];
 125
 126         /* Move 4 bits ahead */
 127         i += 4;
 128       }
 129
 130       /* Damn, something wrong! reset */
 131       else
 132       {
 133         PrintAndLog("Thought we had a valid tag but failed at word %d (i=%d)", rows + 1, i);
 134
 135         /* Start back rows * 5 + 9 header bits, -1 to not start at same place */
 136         i -= 9 + (5 * rows) -5;
 137
 138         rows = header = 0;
 139       }
 140     }
 141
 142     /* Step 3: Got our 40 bits! confirm column parity */
 143     else if (rows == 10)
 144     {
 145       /* We need to make sure our 4 bits of parity are correct and we have a stop bit */
 146       if (BitStream[i] == parity[0] && BitStream[i+1] == parity[1] &&
 147         BitStream[i+2] == parity[2] && BitStream[i+3] == parity[3] &&
 148         BitStream[i+4] == 0)
 149       {
 150         /* Sweet! */
 151         PrintAndLog("EM410x Tag ID: %s", id);
 152         PrintAndLog("Unique Tag ID: %s", id2);
 153
 154                 global_em410xId = id;
 155
 156         /* Stop any loops */
 157         return 1;
 158       }
 159
 160       /* Crap! Incorrect parity or no stop bit, start all over */
 161       else
 162       {
 163         rows = header = 0;
 164
 165         /* Go back 59 bits (9 header bits + 10 rows at 4+1 parity) */
 166         i -= 59;
 167       }
 168     }
 169
 170     /* Step 1: get our header */
 171     else if (header < 9)
 172     {
 173       /* Need 9 consecutive 1's */
 174       if (BitStream[i] == 1)
 175         header++;
 176
 177       /* We don't have a header, not enough consecutive 1 bits */
 178       else
 179         header = 0;
 180     }
 181   }
 182
 183   /* if we've already retested after flipping bits, return */
 184         if (retested++){
 185                 PrintAndLog("Failed to decode");
 186                 return 0;
 187         }
 188
 189   /* if this didn't work, try flipping bits */
 190         for (i = 0; i < bit2idx; i++)
 191                 BitStream[i] ^= 1;
 192
 193   goto retest;
 194 }
 195
 196 /* emulate an EM410X tag
 197  * Format:
 198  *   1111 1111 1           <-- standard non-repeatable header
 199  *   XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
 200  *   ....
 201  *   CCCC                  <-- each bit here is parity for the 10 bits above in corresponding column
 202  *   0                     <-- stop bit, end of tag
 203  */
 204 int CmdEM410xSim(const char *Cmd)
 205 {
 206         int i, n, j, binary[4], parity[4];
 207
 208         char cmdp = param_getchar(Cmd, 0);
 209         uint8_t uid[5] = {0x00};
 210
 211         if (cmdp == 'h' || cmdp == 'H') {
 212                 PrintAndLog("Usage:  lf em4x 410xsim <UID>");
 213                 PrintAndLog("");
 214                 PrintAndLog("     sample: lf em4x 410xsim 0F0368568B");
 215                 return 0;
 216         }
 217
 218         if (param_gethex(Cmd, 0, uid, 10)) {
 219                 PrintAndLog("UID must include 10 HEX symbols");
 220                 return 0;
 221         }
 222
 223         PrintAndLog("Starting simulating UID %02X%02X%02X%02X%02X", uid[0],uid[1],uid[2],uid[3],uid[4]);
 224         PrintAndLog("Press pm3-button to about simulation");
 225
 226   /* clock is 64 in EM410x tags */
 227   int clock = 64;
 228
 229   /* clear our graph */
 230   ClearGraph(0);
 231
 232     /* write 9 start bits */
 233     for (i = 0; i < 9; i++)
 234       AppendGraph(0, clock, 1);
 235
 236     /* for each hex char */
 237     parity[0] = parity[1] = parity[2] = parity[3] = 0;
 238     for (i = 0; i < 10; i++)
 239     {
 240       /* read each hex char */
 241       sscanf(&Cmd[i], "%1x", &n);
 242       for (j = 3; j >= 0; j--, n/= 2)
 243         binary[j] = n % 2;
 244
 245       /* append each bit */
 246       AppendGraph(0, clock, binary[0]);
 247       AppendGraph(0, clock, binary[1]);
 248       AppendGraph(0, clock, binary[2]);
 249       AppendGraph(0, clock, binary[3]);
 250
 251       /* append parity bit */
 252       AppendGraph(0, clock, binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
 253
 254       /* keep track of column parity */
 255       parity[0] ^= binary[0];
 256       parity[1] ^= binary[1];
 257       parity[2] ^= binary[2];
 258       parity[3] ^= binary[3];
 259     }
 260
 261     /* parity columns */
 262     AppendGraph(0, clock, parity[0]);
 263     AppendGraph(0, clock, parity[1]);
 264     AppendGraph(0, clock, parity[2]);
 265     AppendGraph(0, clock, parity[3]);
 266
 267   /* stop bit */
 268   AppendGraph(1, clock, 0);
 269
 270   CmdLFSim("240"); //240 start_gap.
 271   return 0;
 272 }
 273
 274 /* Function is equivalent of lf read + data samples + em410xread
 275  * looped until an EM410x tag is detected
 276  *
 277  * Why is CmdSamples("16000")?
 278  *  TBD: Auto-grow sample size based on detected sample rate.  IE: If the
 279  *       rate gets lower, then grow the number of samples
 280  *  Changed by martin, 4000 x 4 = 16000,
 281  *  see http://www.proxmark.org/forum/viewtopic.php?pid=7235#p7235
 282
 283 */
 284 int CmdEM410xWatch(const char *Cmd)
 285 {
 286         char cmdp = param_getchar(Cmd, 0);
 287         int read_h = (cmdp == 'h');
 288         do {
 289                 if (ukbhit()) {
 290                         printf("\naborted via keyboard!\n");
 291                         break;
 292                 }
 293
 294                 CmdLFRead(read_h ? "h" : "");
 295                 CmdSamples("6000");
 296         } while (
 297                 !CmdEM410xRead("")
 298         );
 299         return 0;
 300 }
 301
 302 int CmdEM410xWatchnSpoof(const char *Cmd)
 303 {
 304         CmdEM410xWatch(Cmd);
 305     PrintAndLog("# Replaying : %s",global_em410xId);
 306     CmdEM410xSim(global_em410xId);
 307   return 0;
 308 }
 309
 310 /* Read the transmitted data of an EM4x50 tag
 311  * Format:
 312  *
 313  *  XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
 314  *  XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
 315  *  XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
 316  *  XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
 317  *  CCCCCCCC                         <- column parity bits
 318  *  0                                <- stop bit
 319  *  LW                               <- Listen Window
 320  *
 321  * This pattern repeats for every block of data being transmitted.
 322  * Transmission starts with two Listen Windows (LW - a modulated
 323  * pattern of 320 cycles each (32/32/128/64/64)).
 324  *
 325  * Note that this data may or may not be the UID. It is whatever data
 326  * is stored in the blocks defined in the control word First and Last
 327  * Word Read values. UID is stored in block 32.
 328  */
 329 int CmdEM4x50Read(const char *Cmd)
 330 {
 331   int i, j, startblock, skip, block, start, end, low, high;
 332   bool complete= false;
 333   int tmpbuff[MAX_GRAPH_TRACE_LEN / 64];
 334   char tmp[6];
 335
 336   high= low= 0;
 337   memset(tmpbuff, 0, MAX_GRAPH_TRACE_LEN / 64);
 338
 339   /* first get high and low values */
 340   for (i = 0; i < GraphTraceLen; i++)
 341   {
 342     if (GraphBuffer[i] > high)
 343       high = GraphBuffer[i];
 344     else if (GraphBuffer[i] < low)
 345       low = GraphBuffer[i];
 346   }
 347
 348   /* populate a buffer with pulse lengths */
 349   i= 0;
 350   j= 0;
 351   while (i < GraphTraceLen)
 352   {
 353     // measure from low to low
 354     while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
 355       ++i;
 356     start= i;
 357     while ((GraphBuffer[i] < high) && (i<GraphTraceLen))
 358       ++i;
 359     while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
 360       ++i;
 361     if (j>=(MAX_GRAPH_TRACE_LEN/64)) {
 362       break;
 363     }
 364     tmpbuff[j++]= i - start;
 365   }
 366
 367   /* look for data start - should be 2 pairs of LW (pulses of 192,128) */
 368   start= -1;
 369   skip= 0;
 370   for (i= 0; i < j - 4 ; ++i)
 371   {
 372     skip += tmpbuff[i];
 373     if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
 374       if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
 375         if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
 376           if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
 377           {
 378             start= i + 3;
 379             break;
 380           }
 381   }
 382   startblock= i + 3;
 383
 384   /* skip over the remainder of the LW */
 385   skip += tmpbuff[i+1]+tmpbuff[i+2];
 386   while (skip < MAX_GRAPH_TRACE_LEN && GraphBuffer[skip] > low)
 387     ++skip;
 388   skip += 8;
 389
 390   /* now do it again to find the end */
 391   end= start;
 392   for (i += 3; i < j - 4 ; ++i)
 393   {
 394     end += tmpbuff[i];
 395     if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
 396       if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
 397         if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
 398           if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
 399           {
 400             complete= true;
 401             break;
 402           }
 403   }
 404
 405   if (start >= 0)
 406     PrintAndLog("Found data at sample: %i",skip);
 407   else
 408   {
 409     PrintAndLog("No data found!");
 410     PrintAndLog("Try again with more samples.");
 411     return 0;
 412   }
 413
 414   if (!complete)
 415   {
 416     PrintAndLog("*** Warning!");
 417     PrintAndLog("Partial data - no end found!");
 418     PrintAndLog("Try again with more samples.");
 419   }
 420
 421   /* get rid of leading crap */
 422   sprintf(tmp,"%i",skip);
 423   CmdLtrim(tmp);
 424
 425   /* now work through remaining buffer printing out data blocks */
 426   block= 0;
 427   i= startblock;
 428   while (block < 6)
 429   {
 430     PrintAndLog("Block %i:", block);
 431     // mandemod routine needs to be split so we can call it for data
 432     // just print for now for debugging
 433     CmdManchesterDemod("i 64");
 434     skip= 0;
 435     /* look for LW before start of next block */
 436     for ( ; i < j - 4 ; ++i)
 437     {
 438       skip += tmpbuff[i];
 439       if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
 440         if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
 441           break;
 442     }
 443     while (GraphBuffer[skip] > low)
 444       ++skip;
 445     skip += 8;
 446     sprintf(tmp,"%i",skip);
 447     CmdLtrim(tmp);
 448     start += skip;
 449     block++;
 450   }
 451   return 0;
 452 }
 453
 454 int CmdEM410xWrite(const char *Cmd)
 455 {
 456   uint64_t id = 0xFFFFFFFFFFFFFFFF; // invalid id value
 457   int card = 0xFF; // invalid card value
 458         unsigned int clock = 0; // invalid clock value
 459
 460         sscanf(Cmd, "%" PRIx64 " %d %d", &id, &card, &clock);
 461
 462         // Check ID
 463         if (id == 0xFFFFFFFFFFFFFFFF) {
 464                 PrintAndLog("Error! ID is required.\n");
 465                 return 0;
 466         }
 467         if (id >= 0x10000000000) {
 468                 PrintAndLog("Error! Given EM410x ID is longer than 40 bits.\n");
 469                 return 0;
 470         }
 471
 472         // Check Card
 473         if (card == 0xFF) {
 474                 PrintAndLog("Error! Card type required.\n");
 475                 return 0;
 476         }
 477         if (card < 0) {
 478                 PrintAndLog("Error! Bad card type selected.\n");
 479                 return 0;
 480         }
 481
 482         // Check Clock
 483         if (card == 1)
 484         {
 485                 // Default: 64
 486                 if (clock == 0)
 487                         clock = 64;
 488
 489                 // Allowed clock rates: 16, 32 and 64
 490                 if ((clock != 16) && (clock != 32) && (clock != 64)) {
 491                         PrintAndLog("Error! Clock rate %d not valid. Supported clock rates are 16, 32 and 64.\n", clock);
 492                         return 0;
 493                 }
 494         }
 495         else if (clock != 0)
 496         {
 497                 PrintAndLog("Error! Clock rate is only supported on T55x7 tags.\n");
 498                 return 0;
 499         }
 500
 501         if (card == 1) {
 502                 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64 " (clock rate: %d)", "T55x7", id, clock);
 503                 // NOTE: We really should pass the clock in as a separate argument, but to
 504                 //   provide for backwards-compatibility for older firmware, and to avoid
 505                 //   having to add another argument to CMD_EM410X_WRITE_TAG, we just store
 506                 //   the clock rate in bits 8-15 of the card value
 507                 card = (card & 0xFF) | (((uint64_t)clock << 8) & 0xFF00);
 508         }
 509         else if (card == 0)
 510                 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64, "T5555", id, clock);
 511         else {
 512                 PrintAndLog("Error! Bad card type selected.\n");
 513                 return 0;
 514         }
 515
 516   UsbCommand c = {CMD_EM410X_WRITE_TAG, {card, (uint32_t)(id >> 32), (uint32_t)id}};
 517   SendCommand(&c);
 518
 519   return 0;
 520 }
 521
 522 int CmdReadWord(const char *Cmd)
 523 {
 524         int Word = -1; //default to invalid word
 525         UsbCommand c;
 526
 527         sscanf(Cmd, "%d", &Word);
 528
 529         if ( (Word > 15) | (Word < 0) ) {
 530                 PrintAndLog("Word must be between 0 and 15");
 531                 return 1;
 532         }
 533
 534         PrintAndLog("Reading word %d", Word);
 535
 536         c.cmd = CMD_EM4X_READ_WORD;
 537         c.d.asBytes[0] = 0x0; //Normal mode
 538         c.arg[0] = 0;
 539         c.arg[1] = Word;
 540         c.arg[2] = 0;
 541         SendCommand(&c);
 542         WaitForResponse(CMD_ACK, NULL);
 543
 544         uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
 545
 546         GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,0);  //3560 -- should be offset..
 547         WaitForResponseTimeout(CMD_ACK,NULL, 1500);
 548
 549         for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
 550                 GraphBuffer[j] = ((int)data[j]);
 551         }
 552         GraphTraceLen = LF_TRACE_BUFF_SIZE;
 553
 554         uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
 555         uint8_t * bitstream = bits;
 556         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream,LF_BITSSTREAM_LEN);
 557         RepaintGraphWindow();
 558   return 0;
 559 }
 560
 561 int CmdReadWordPWD(const char *Cmd)
 562 {
 563         int Word = -1; //default to invalid word
 564         int Password = 0xFFFFFFFF; //default to blank password
 565         UsbCommand c;
 566
 567         sscanf(Cmd, "%d %x", &Word, &Password);
 568
 569         if ( (Word > 15) | (Word < 0) ) {
 570                 PrintAndLog("Word must be between 0 and 15");
 571                 return 1;
 572         }
 573
 574         PrintAndLog("Reading word %d with password %08X", Word, Password);
 575
 576         c.cmd = CMD_EM4X_READ_WORD;
 577         c.d.asBytes[0] = 0x1; //Password mode
 578         c.arg[0] = 0;
 579         c.arg[1] = Word;
 580         c.arg[2] = Password;
 581         SendCommand(&c);
 582         WaitForResponse(CMD_ACK, NULL);
 583
 584         uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
 585
 586         GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,0);  //3560 -- should be offset..
 587         WaitForResponseTimeout(CMD_ACK,NULL, 1500);
 588
 589         for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
 590                 GraphBuffer[j] = ((int)data[j]);
 591         }
 592         GraphTraceLen = LF_TRACE_BUFF_SIZE;
 593
 594         uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
 595         uint8_t * bitstream = bits;
 596         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream, LF_BITSSTREAM_LEN);
 597         RepaintGraphWindow();
 598   return 0;
 599 }
 600
 601 int CmdWriteWord(const char *Cmd)
 602 {
 603   int Word = 16; //default to invalid block
 604   int Data = 0xFFFFFFFF; //default to blank data
 605   UsbCommand c;
 606
 607   sscanf(Cmd, "%x %d", &Data, &Word);
 608
 609   if (Word > 15) {
 610     PrintAndLog("Word must be between 0 and 15");
 611     return 1;
 612   }
 613
 614   PrintAndLog("Writing word %d with data %08X", Word, Data);
 615
 616   c.cmd = CMD_EM4X_WRITE_WORD;
 617   c.d.asBytes[0] = 0x0; //Normal mode
 618   c.arg[0] = Data;
 619   c.arg[1] = Word;
 620   c.arg[2] = 0;
 621   SendCommand(&c);
 622   return 0;
 623 }
 624
 625 int CmdWriteWordPWD(const char *Cmd)
 626 {
 627   int Word = 16; //default to invalid word
 628   int Data = 0xFFFFFFFF; //default to blank data
 629   int Password = 0xFFFFFFFF; //default to blank password
 630   UsbCommand c;
 631
 632   sscanf(Cmd, "%x %d %x", &Data, &Word, &Password);
 633
 634   if (Word > 15) {
 635     PrintAndLog("Word must be between 0 and 15");
 636     return 1;
 637   }
 638
 639   PrintAndLog("Writing word %d with data %08X and password %08X", Word, Data, Password);
 640
 641   c.cmd = CMD_EM4X_WRITE_WORD;
 642   c.d.asBytes[0] = 0x1; //Password mode
 643   c.arg[0] = Data;
 644   c.arg[1] = Word;
 645   c.arg[2] = Password;
 646   SendCommand(&c);
 647   return 0;
 648 }
 649
 650 static command_t CommandTable[] =
 651 {
 652   {"help", CmdHelp, 1, "This help"},
 653   {"410xdemod", CmdEMdemodASK, 0, "[clock rate] -- Extract ID from EM410x tag"},
 654   {"410xread", CmdEM410xRead, 1, "[clock rate] -- Extract ID from EM410x tag"},
 655   {"410xsim", CmdEM410xSim, 0, "<UID> -- Simulate EM410x tag"},
 656   {"replay",  MWRem4xReplay, 0, "Watches for tag and simulates manchester encoded em4x tag"},
 657   {"410xwatch", CmdEM410xWatch, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"},
 658   {"410xspoof", CmdEM410xWatchnSpoof, 0, "['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)" },
 659   {"410xwrite", CmdEM410xWrite, 1, "<UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"},
 660   {"4x50read", CmdEM4x50Read, 1, "Extract data from EM4x50 tag"},
 661   {"rd", CmdReadWord, 1, "<Word 1-15> -- Read EM4xxx word data"},
 662   {"rdpwd", CmdReadWordPWD, 1, "<Word 1-15> <Password> -- Read EM4xxx word data  in password mode "},
 663   {"wr", CmdWriteWord, 1, "<Data> <Word 1-15> -- Write EM4xxx word data"},
 664   {"wrpwd", CmdWriteWordPWD, 1, "<Data> <Word 1-15> <Password> -- Write EM4xxx word data in password mode"},
 665   {NULL, NULL, 0, NULL}
 666 };
 667
 668
 669 //Confirms the parity of a bitstream as well as obtaining the data (TagID) from within the appropriate memory space.
 670 //Arguments:
 671 // Pointer to a string containing the desired bitsream
 672 // Pointer to a string that will receive the decoded tag ID
 673 // Length of the bitsream pointed at in the first argument, char* _strBitStream
 674 //Retuns:
 675 //1 Parity confirmed
 676 //0 Parity not confirmed
 677 int ConfirmEm410xTagParity( char* _strBitStream, char* pID, int LengthOfBitstream )
 678 {
 679         int i = 0;
 680         int rows = 0;
 681         int Parity[4] = {0x00};
 682         char ID[11] = {0x00};
 683         int k = 0;
 684         int BitStream[70] = {0x00};
 685         int counter = 0;
 686         //prepare variables
 687         for ( i = 0; i <= LengthOfBitstream; i++)
 688         {
 689                 if (_strBitStream[i] == '1')
 690                 {
 691                         k =1;
 692                         memcpy(&BitStream[i], &k,4);
 693                 }
 694                 else if (_strBitStream[i] == '0')
 695                 {
 696                         k = 0;
 697                         memcpy(&BitStream[i], &k,4);
 698                 }
 699         }
 700         while ( counter < 2 )
 701         {
 702                 //set/reset variables and counters
 703                 memset(ID,0x00,sizeof(ID));
 704                 memset(Parity,0x00,sizeof(Parity));
 705                 rows = 0;
 706                 for ( i = 9; i <= LengthOfBitstream; i++)
 707                 {
 708                         if ( rows < 10 )
 709                         {
 710                                 if ((BitStream[i] ^ BitStream[i+1] ^ BitStream[i+2] ^ BitStream[i+3]) == BitStream[i+4])
 711                                 {
 712                                         sprintf(ID+rows, "%x", (8 * BitStream[i]) + (4 * BitStream[i+1]) + (2 * BitStream[i+2]) + (1 * BitStream[i+3]));
 713                                         rows++;
 714                                         /* Keep parity info and move four bits ahead*/
 715                                         Parity[0] ^= BitStream[i];
 716                                         Parity[1] ^= BitStream[i+1];
 717                                         Parity[2] ^= BitStream[i+2];
 718                                         Parity[3] ^= BitStream[i+3];
 719                                         i += 4;
 720                                 }
 721                         }
 722                         if ( rows == 10 )
 723                         {
 724                                 if (    BitStream[i] == Parity[0] && BitStream[i+1] == Parity[1] &&
 725                                         BitStream[i+2] == Parity[2] && BitStream[i+3] == Parity[3] &&
 726                                         BitStream[i+4] == 0)
 727                                 {
 728                                         memcpy(pID,ID,strlen(ID));
 729                                         return 1;
 730                                 }
 731                         }
 732                 }
 733                 printf("[PARITY ->]Failed. Flipping Bits, and rechecking parity for bitstream:\n[PARITY ->]");
 734                 for (k = 0; k < LengthOfBitstream; k++)
 735                 {
 736                         BitStream[k] ^= 1;
 737                         printf("%i", BitStream[k]);
 738                 }
 739                 puts(" ");
 740                 counter++;
 741         }
 742         return 0;
 743 }
 744 //Reads and demodulates an em410x RFID tag. It further allows slight modification to the decoded bitstream
 745 //Once a suitable bitstream has been identified, and if needed, modified, it is replayed. Allowing emulation of the
 746 //"stolen" rfid tag.
 747 //No meaningful returns or arguments.
 748 int MWRem4xReplay(const char* Cmd)
 749 {
 750         // //header traces
 751         // static char ArrayTraceZero[] = { '0','0','0','0','0','0','0','0','0' };
 752         // static char ArrayTraceOne[] =  { '1','1','1','1','1','1','1','1','1' };
 753         // //local string variables
 754         // char strClockRate[10] = {0x00};
 755         // char strAnswer[4] = {0x00};
 756         // char strTempBufferMini[2] = {0x00};
 757         // //our outbound bit-stream
 758         // char strSimulateBitStream[65] = {0x00};
 759         // //integers
 760         // int iClockRate = 0;
 761         // int needle = 0;
 762         // int j = 0;
 763         // int iFirstHeaderOffset = 0x00000000;
 764         // int numManchesterDemodBits=0;
 765         // //boolean values
 766         // bool bInverted = false;
 767         // //pointers to strings. memory will be allocated.
 768         // char* pstrInvertBitStream = 0x00000000;
 769         // char* pTempBuffer = 0x00000000;
 770         // char* pID = 0x00000000;
 771         // char* strBitStreamBuffer = 0x00000000;
 772
 773
 774         // puts("###################################");
 775         // puts("#### Em4x Replay                 ##");
 776         // puts("#### R.A.M.           June 2013  ##");
 777         // puts("###################################");
 778         // //initialize
 779         // CmdLFRead("");
 780         // //Collect ourselves 10,000 samples
 781         // CmdSamples("10000");
 782         // puts("[->]preforming ASK demodulation\n");
 783         // //demodulate ask
 784         // Cmdaskdemod("0");
 785         // iClockRate = DetectClock(0);
 786         // sprintf(strClockRate, "%i\n",iClockRate);
 787         // printf("[->]Detected ClockRate: %s\n", strClockRate);
 788
 789         // //If detected clock rate is something completely unreasonable, dont go ahead
 790         // if ( iClockRate < 0xFFFE )
 791         // {
 792             // pTempBuffer = (char*)malloc(MAX_GRAPH_TRACE_LEN);
 793             // if (pTempBuffer == 0x00000000)
 794               // return 0;
 795             // memset(pTempBuffer,0x00,MAX_GRAPH_TRACE_LEN);
 796             // //Preform manchester de-modulation and display in a single line.
 797             // numManchesterDemodBits = CmdManchesterDemod( strClockRate );
 798             // //note: numManchesterDemodBits is set above in CmdManchesterDemod()
 799             // if ( numManchesterDemodBits == 0 )
 800               // return 0;
 801             // strBitStreamBuffer = malloc(numManchesterDemodBits+1);
 802             // if ( strBitStreamBuffer == 0x00000000 )
 803                 // return 0;
 804             // memset(strBitStreamBuffer, 0x00, (numManchesterDemodBits+1));
 805             // //fill strBitStreamBuffer with demodulated, string formatted bits.
 806             // for ( j = 0; j <= numManchesterDemodBits; j++ )
 807             // {
 808                 // sprintf(strTempBufferMini, "%i",BitStream[j]);
 809                 // strcat(strBitStreamBuffer,strTempBufferMini);
 810             // }
 811             // printf("[->]Demodulated Bitstream: \n%s\n", strBitStreamBuffer);
 812             // //Reset counter and select most probable bit stream
 813             // j = 0;
 814                 // while ( j < numManchesterDemodBits )
 815                 // {
 816                     // memset(strSimulateBitStream,0x00,64);
 817                     // //search for header of nine (9) 0's : 000000000 or nine (9) 1's : 1111 1111 1
 818                         // if ( ( strncmp(strBitStreamBuffer+j, ArrayTraceZero, sizeof(ArrayTraceZero)) == 0 ) ||
 819                             // ( strncmp(strBitStreamBuffer+j, ArrayTraceOne, sizeof(ArrayTraceOne)) == 0  ) )
 820                         // {
 821                                 // iFirstHeaderOffset = j;
 822                             // memcpy(strSimulateBitStream, strBitStreamBuffer+j,64);
 823                             // printf("[->]Offset of Header");
 824                                 // if ( strncmp(strBitStreamBuffer+iFirstHeaderOffset, "0", 1) == 0 )
 825                                         // printf("'%s'", ArrayTraceZero );
 826                                 // else
 827                                         // printf("'%s'", ArrayTraceOne );
 828                                 // printf(": %i\nHighlighted string : %s\n",iFirstHeaderOffset,strSimulateBitStream);
 829                             // //allow us to escape loop or choose another frame
 830                             // puts("[<-]Are we happy with this sample? [Y]es/[N]o");
 831                             // gets(strAnswer);
 832                             // if ( ( strncmp(strAnswer,"y",1) == 0 )  || ( strncmp(strAnswer,"Y",1) == 0 ) )
 833                             // {
 834                                     // j = numManchesterDemodBits+1;
 835                                     // break;
 836                             // }
 837                         // }
 838                         // j++;
 839                 // }
 840         // }
 841         // else return 0;
 842
 843         // //Do we want the buffer inverted?
 844         // memset(strAnswer, 0x00, sizeof(strAnswer));
 845         // printf("[<-]Do you wish to invert the highlighted bitstream? [Y]es/[N]o\n");
 846         // gets(strAnswer);
 847         // if ( ( strncmp("y", strAnswer,1) == 0 )  || ( strncmp("Y", strAnswer, 1 ) == 0 ) )
 848         // {
 849                 // //allocate heap memory
 850                 // pstrInvertBitStream = (char*)malloc(numManchesterDemodBits);
 851                 // if ( pstrInvertBitStream != 0x00000000 )
 852                 // {
 853                         // memset(pstrInvertBitStream,0x00,numManchesterDemodBits);
 854                         // bInverted = true;
 855                         // //Invert Bitstream
 856                         // for ( needle = 0; needle <= numManchesterDemodBits; needle++ )
 857                         // {
 858                                 // if (strSimulateBitStream[needle] == '0')
 859                                         // strcat(pstrInvertBitStream,"1");
 860                                 // else if (strSimulateBitStream[needle] == '1')
 861                                         // strcat(pstrInvertBitStream,"0");
 862                         // }
 863                         // printf("[->]Inverted bitstream: %s\n", pstrInvertBitStream);
 864                 // }
 865         // }
 866     // //Confirm parity of selected string
 867         // pID = (char*)malloc(11);
 868         // if (pID != 0x00000000)
 869         // {
 870                 // memset(pID, 0x00, 11);
 871                 // if (ConfirmEm410xTagParity(strSimulateBitStream,pID, 64) == 1)
 872                 // {
 873                         // printf("[->]Parity confirmed for selected bitstream!\n");
 874                         // printf("[->]Tag ID was detected as: [hex]:%s\n",pID );
 875                 // }
 876                 // else
 877                         // printf("[->]Parity check failed for the selected bitstream!\n");
 878         // }
 879
 880         // //Spoof
 881         // memset(strAnswer, 0x00, sizeof(strAnswer));
 882         // printf("[<-]Do you wish to continue with the EM4x simulation? [Y]es/[N]o\n");
 883         // gets(strAnswer);
 884         // if ( ( strncmp(strAnswer,"y",1) == 0 )  || ( strncmp(strAnswer,"Y",1) == 0 ) )
 885         // {
 886                 // strcat(pTempBuffer, strClockRate);
 887                 // strcat(pTempBuffer, " ");
 888                 // if (bInverted == true)
 889                         // strcat(pTempBuffer,pstrInvertBitStream);
 890                 // if (bInverted == false)
 891                         // strcat(pTempBuffer,strSimulateBitStream);
 892                 // //inform the user
 893                 // puts("[->]Starting simulation now: \n");
 894                 // //Simulate tag with prepared buffer.
 895                 // CmdLFSimManchester(pTempBuffer);
 896         // }
 897         // else if ( ( strcmp("n", strAnswer) == 0 )  || ( strcmp("N", strAnswer ) == 0 ) )
 898                 // printf("[->]Exiting procedure now...\n");
 899         // else
 900                 // printf("[->]Erroneous selection\nExiting procedure now....\n");
 901
 902         // //Clean up -- Exit function
 903         // //clear memory, then release pointer.
 904         // if ( pstrInvertBitStream != 0x00000000 )
 905         // {
 906             // memset(pstrInvertBitStream,0x00,numManchesterDemodBits);
 907             // free(pstrInvertBitStream);
 908         // }
 909         // if ( pTempBuffer != 0x00000000 )
 910         // {
 911             // memset(pTempBuffer,0x00,MAX_GRAPH_TRACE_LEN);
 912             // free(pTempBuffer);
 913         // }
 914         // if ( pID != 0x00000000 )
 915         // {
 916             // memset(pID,0x00,11);
 917             // free(pID);
 918         // }
 919         // if ( strBitStreamBuffer != 0x00000000 )
 920         // {
 921             // memset(strBitStreamBuffer,0x00,numManchesterDemodBits);
 922             // free(strBitStreamBuffer);
 923         // }
 924         return 0;
 925 }
 926
 927 int CmdLFEM4X(const char *Cmd)
 928 {
 929   CmdsParse(CommandTable, Cmd);
 930   return 0;
 931 }
 932
 933 int CmdHelp(const char *Cmd)
 934 {
 935   CmdsHelp(CommandTable);
 936   return 0;
 937 }