]>
cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfem4x.c
1ce937d97e58350508d28c5b90dd46ef5ceac260
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // Low frequency EM4x commands
9 //-----------------------------------------------------------------------------
14 #include "proxmark3.h"
18 #include "cmdparser.h"
21 #include "cmdlfem4x.h"
24 #define LF_TRACE_BUFF_SIZE 12000
25 #define LF_BITSSTREAM_LEN 1000
27 char *global_em410xId
;
29 static int CmdHelp(const char *Cmd
);
31 /* Read the ID of an EM410x tag.
33 * 1111 1111 1 <-- standard non-repeatable header
34 * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
36 * CCCC <-- each bit here is parity for the 10 bits above in corresponding column
37 * 0 <-- stop bit, end of tag
39 int CmdEM410xRead(const char *Cmd
)
41 int i
, j
, clock
, header
, rows
, bit
, hithigh
, hitlow
, first
, bit2idx
, high
, low
;
46 uint8_t BitStream
[MAX_GRAPH_TRACE_LEN
];
49 /* Detect high and lows and clock */
50 for (i
= 0; i
< GraphTraceLen
; i
++)
52 if (GraphBuffer
[i
] > high
)
53 high
= GraphBuffer
[i
];
54 else if (GraphBuffer
[i
] < low
)
59 clock
= GetClock(Cmd
, high
, 0);
61 /* parity for our 4 columns */
62 parity
[0] = parity
[1] = parity
[2] = parity
[3] = 0;
65 /* manchester demodulate */
67 for (i
= 0; i
< (int)(GraphTraceLen
/ clock
); i
++)
73 /* Find out if we hit both high and low peaks */
74 for (j
= 0; j
< clock
; j
++)
76 if (GraphBuffer
[(i
* clock
) + j
] == high
)
78 else if (GraphBuffer
[(i
* clock
) + j
] == low
)
81 /* it doesn't count if it's the first part of our read
82 because it's really just trailing from the last sequence */
83 if (first
&& (hithigh
|| hitlow
))
88 if (hithigh
&& hitlow
)
92 /* If we didn't hit both high and low peaks, we had a bit transition */
93 if (!hithigh
|| !hitlow
)
96 BitStream
[bit2idx
++] = bit
;
100 /* We go till 5 before the graph ends because we'll get that far below */
101 for (i
= 1; i
< bit2idx
- 5; i
++)
103 /* Step 2: We have our header but need our tag ID */
104 if (header
== 9 && rows
< 10)
106 /* Confirm parity is correct */
107 if ((BitStream
[i
] ^ BitStream
[i
+1] ^ BitStream
[i
+2] ^ BitStream
[i
+3]) == BitStream
[i
+4])
109 /* Read another byte! */
110 sprintf(id
+rows
, "%x", (8 * BitStream
[i
]) + (4 * BitStream
[i
+1]) + (2 * BitStream
[i
+2]) + (1 * BitStream
[i
+3]));
111 sprintf(id2
+rows
, "%x", (8 * BitStream
[i
+3]) + (4 * BitStream
[i
+2]) + (2 * BitStream
[i
+1]) + (1 * BitStream
[i
]));
114 /* Keep parity info */
115 parity
[0] ^= BitStream
[i
];
116 parity
[1] ^= BitStream
[i
+1];
117 parity
[2] ^= BitStream
[i
+2];
118 parity
[3] ^= BitStream
[i
+3];
120 /* Move 4 bits ahead */
124 /* Damn, something wrong! reset */
127 PrintAndLog("Thought we had a valid tag but failed at word %d (i=%d)", rows
+ 1, i
);
129 /* Start back rows * 5 + 9 header bits, -1 to not start at same place */
130 i
-= 9 + (5 * rows
) - 5;
136 /* Step 3: Got our 40 bits! confirm column parity */
139 /* We need to make sure our 4 bits of parity are correct and we have a stop bit */
140 if (BitStream
[i
] == parity
[0] && BitStream
[i
+1] == parity
[1] &&
141 BitStream
[i
+2] == parity
[2] && BitStream
[i
+3] == parity
[3] &&
145 PrintAndLog("EM410x Tag ID: %s", id
);
146 PrintAndLog("Unique Tag ID: %s", id2
);
148 global_em410xId
= id
;
154 /* Crap! Incorrect parity or no stop bit, start all over */
159 /* Go back 59 bits (9 header bits + 10 rows at 4+1 parity) */
164 /* Step 1: get our header */
167 /* Need 9 consecutive 1's */
168 if (BitStream
[i
] == 1)
171 /* We don't have a header, not enough consecutive 1 bits */
177 /* if we've already retested after flipping bits, return */
182 /* if this didn't work, try flipping bits */
183 for (i
= 0; i
< bit2idx
; i
++)
189 /* emulate an EM410X tag
191 * 1111 1111 1 <-- standard non-repeatable header
192 * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
194 * CCCC <-- each bit here is parity for the 10 bits above in corresponding column
195 * 0 <-- stop bit, end of tag
197 int CmdEM410xSim(const char *Cmd
)
199 int i
, n
, j
, h
, binary
[4], parity
[4];
201 /* clock is 64 in EM410x tags */
204 /* clear our graph */
207 /* write it out a few times */
208 for (h
= 0; h
< 4; h
++)
210 /* write 9 start bits */
211 for (i
= 0; i
< 9; i
++)
212 AppendGraph(0, clock
, 1);
214 /* for each hex char */
215 parity
[0] = parity
[1] = parity
[2] = parity
[3] = 0;
216 for (i
= 0; i
< 10; i
++)
218 /* read each hex char */
219 sscanf(&Cmd
[i
], "%1x", &n
);
220 for (j
= 3; j
>= 0; j
--, n
/= 2)
223 /* append each bit */
224 AppendGraph(0, clock
, binary
[0]);
225 AppendGraph(0, clock
, binary
[1]);
226 AppendGraph(0, clock
, binary
[2]);
227 AppendGraph(0, clock
, binary
[3]);
229 /* append parity bit */
230 AppendGraph(0, clock
, binary
[0] ^ binary
[1] ^ binary
[2] ^ binary
[3]);
232 /* keep track of column parity */
233 parity
[0] ^= binary
[0];
234 parity
[1] ^= binary
[1];
235 parity
[2] ^= binary
[2];
236 parity
[3] ^= binary
[3];
240 AppendGraph(0, clock
, parity
[0]);
241 AppendGraph(0, clock
, parity
[1]);
242 AppendGraph(0, clock
, parity
[2]);
243 AppendGraph(0, clock
, parity
[3]);
246 AppendGraph(0, clock
, 0);
249 /* modulate that biatch */
250 CmdManchesterMod("");
253 RepaintGraphWindow();
259 /* Function is equivalent of lf read + data samples + em410xread
260 * looped until an EM410x tag is detected
262 * Why is CmdSamples("16000")?
263 * TBD: Auto-grow sample size based on detected sample rate. IE: If the
264 * rate gets lower, then grow the number of samples
265 * Changed by martin, 4000 x 4 = 16000,
266 * see http://www.proxmark.org/forum/viewtopic.php?pid=7235#p7235
269 int CmdEM410xWatch(const char *Cmd
)
271 int read_h
= (*Cmd
== 'h');
274 CmdLFRead(read_h
? "h" : "");
282 int CmdEM410xWatchnSpoof(const char *Cmd
)
285 PrintAndLog("# Replaying : %s",global_em410xId
);
286 CmdEM410xSim(global_em410xId
);
290 /* Read the transmitted data of an EM4x50 tag
293 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
294 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
295 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
296 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
297 * CCCCCCCC <- column parity bits
299 * LW <- Listen Window
301 * This pattern repeats for every block of data being transmitted.
302 * Transmission starts with two Listen Windows (LW - a modulated
303 * pattern of 320 cycles each (32/32/128/64/64)).
305 * Note that this data may or may not be the UID. It is whatever data
306 * is stored in the blocks defined in the control word First and Last
307 * Word Read values. UID is stored in block 32.
309 int CmdEM4x50Read(const char *Cmd
)
311 int i
, j
, startblock
, skip
, block
, start
, end
, low
, high
;
312 bool complete
= false;
313 int tmpbuff
[MAX_GRAPH_TRACE_LEN
/ 64];
317 memset(tmpbuff
, 0, MAX_GRAPH_TRACE_LEN
/ 64);
319 /* first get high and low values */
320 for (i
= 0; i
< GraphTraceLen
; i
++)
322 if (GraphBuffer
[i
] > high
)
323 high
= GraphBuffer
[i
];
324 else if (GraphBuffer
[i
] < low
)
325 low
= GraphBuffer
[i
];
328 /* populate a buffer with pulse lengths */
331 while (i
< GraphTraceLen
)
333 // measure from low to low
334 while ((GraphBuffer
[i
] > low
) && (i
<GraphTraceLen
))
337 while ((GraphBuffer
[i
] < high
) && (i
<GraphTraceLen
))
339 while ((GraphBuffer
[i
] > low
) && (i
<GraphTraceLen
))
341 if (j
>(MAX_GRAPH_TRACE_LEN
/64)) {
344 tmpbuff
[j
++]= i
- start
;
347 /* look for data start - should be 2 pairs of LW (pulses of 192,128) */
350 for (i
= 0; i
< j
- 4 ; ++i
)
353 if (tmpbuff
[i
] >= 190 && tmpbuff
[i
] <= 194)
354 if (tmpbuff
[i
+1] >= 126 && tmpbuff
[i
+1] <= 130)
355 if (tmpbuff
[i
+2] >= 190 && tmpbuff
[i
+2] <= 194)
356 if (tmpbuff
[i
+3] >= 126 && tmpbuff
[i
+3] <= 130)
364 /* skip over the remainder of the LW */
365 skip
+= tmpbuff
[i
+1]+tmpbuff
[i
+2];
366 while (skip
< MAX_GRAPH_TRACE_LEN
&& GraphBuffer
[skip
] > low
)
370 /* now do it again to find the end */
372 for (i
+= 3; i
< j
- 4 ; ++i
)
375 if (tmpbuff
[i
] >= 190 && tmpbuff
[i
] <= 194)
376 if (tmpbuff
[i
+1] >= 126 && tmpbuff
[i
+1] <= 130)
377 if (tmpbuff
[i
+2] >= 190 && tmpbuff
[i
+2] <= 194)
378 if (tmpbuff
[i
+3] >= 126 && tmpbuff
[i
+3] <= 130)
386 PrintAndLog("Found data at sample: %i",skip
);
389 PrintAndLog("No data found!");
390 PrintAndLog("Try again with more samples.");
396 PrintAndLog("*** Warning!");
397 PrintAndLog("Partial data - no end found!");
398 PrintAndLog("Try again with more samples.");
401 /* get rid of leading crap */
402 sprintf(tmp
,"%i",skip
);
405 /* now work through remaining buffer printing out data blocks */
410 PrintAndLog("Block %i:", block
);
411 // mandemod routine needs to be split so we can call it for data
412 // just print for now for debugging
413 CmdManchesterDemod("i 64");
415 /* look for LW before start of next block */
416 for ( ; i
< j
- 4 ; ++i
)
419 if (tmpbuff
[i
] >= 190 && tmpbuff
[i
] <= 194)
420 if (tmpbuff
[i
+1] >= 126 && tmpbuff
[i
+1] <= 130)
423 while (GraphBuffer
[skip
] > low
)
426 sprintf(tmp
,"%i",skip
);
434 int CmdEM410xWrite(const char *Cmd
)
436 uint64_t id
= 0xFFFFFFFFFFFFFFFF; // invalid id value
437 int card
= 0xFF; // invalid card value
438 unsigned int clock
= 0; // invalid clock value
440 sscanf(Cmd
, "%" PRIx64
" %d %d", &id
, &card
, &clock
);
443 if (id
== 0xFFFFFFFFFFFFFFFF) {
444 PrintAndLog("Error! ID is required.\n");
447 if (id
>= 0x10000000000) {
448 PrintAndLog("Error! Given EM410x ID is longer than 40 bits.\n");
454 PrintAndLog("Error! Card type required.\n");
458 PrintAndLog("Error! Bad card type selected.\n");
469 // Allowed clock rates: 16, 32 and 64
470 if ((clock
!= 16) && (clock
!= 32) && (clock
!= 64)) {
471 PrintAndLog("Error! Clock rate %d not valid. Supported clock rates are 16, 32 and 64.\n", clock
);
477 PrintAndLog("Error! Clock rate is only supported on T55x7 tags.\n");
482 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64
" (clock rate: %d)", "T55x7", id
, clock
);
483 // NOTE: We really should pass the clock in as a separate argument, but to
484 // provide for backwards-compatibility for older firmware, and to avoid
485 // having to add another argument to CMD_EM410X_WRITE_TAG, we just store
486 // the clock rate in bits 8-15 of the card value
487 card
= (card
& 0xFF) | (((uint64_t)clock
<< 8) & 0xFF00);
490 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64
, "T5555", id
, clock
);
492 PrintAndLog("Error! Bad card type selected.\n");
496 UsbCommand c
= {CMD_EM410X_WRITE_TAG
, {card
, (uint32_t)(id
>> 32), (uint32_t)id
}};
502 int CmdReadWord(const char *Cmd
)
504 int Word
= -1; //default to invalid word
507 sscanf(Cmd
, "%d", &Word
);
509 if ( (Word
> 15) | (Word
< 0) ) {
510 PrintAndLog("Word must be between 0 and 15");
514 PrintAndLog("Reading word %d", Word
);
516 c
.cmd
= CMD_EM4X_READ_WORD
;
517 c
.d
.asBytes
[0] = 0x0; //Normal mode
522 WaitForResponse(CMD_ACK
, NULL
);
524 uint8_t data
[LF_TRACE_BUFF_SIZE
] = {0x00};
526 GetFromBigBuf(data
,LF_TRACE_BUFF_SIZE
,3560); //3560 -- should be offset..
527 WaitForResponseTimeout(CMD_ACK
,NULL
, 1500);
529 for (int j
= 0; j
< LF_TRACE_BUFF_SIZE
; j
++) {
530 GraphBuffer
[j
] = ((int)data
[j
]);
532 GraphTraceLen
= LF_TRACE_BUFF_SIZE
;
534 uint8_t bits
[LF_BITSSTREAM_LEN
] = {0x00};
535 uint8_t * bitstream
= bits
;
536 manchester_decode(GraphBuffer
, LF_TRACE_BUFF_SIZE
, bitstream
,LF_BITSSTREAM_LEN
);
537 RepaintGraphWindow();
541 int CmdReadWordPWD(const char *Cmd
)
543 int Word
= -1; //default to invalid word
544 int Password
= 0xFFFFFFFF; //default to blank password
547 sscanf(Cmd
, "%d %x", &Word
, &Password
);
549 if ( (Word
> 15) | (Word
< 0) ) {
550 PrintAndLog("Word must be between 0 and 15");
554 PrintAndLog("Reading word %d with password %08X", Word
, Password
);
556 c
.cmd
= CMD_EM4X_READ_WORD
;
557 c
.d
.asBytes
[0] = 0x1; //Password mode
562 WaitForResponse(CMD_ACK
, NULL
);
564 uint8_t data
[LF_TRACE_BUFF_SIZE
] = {0x00};
566 GetFromBigBuf(data
,LF_TRACE_BUFF_SIZE
,3560); //3560 -- should be offset..
567 WaitForResponseTimeout(CMD_ACK
,NULL
, 1500);
569 for (int j
= 0; j
< LF_TRACE_BUFF_SIZE
; j
++) {
570 GraphBuffer
[j
] = ((int)data
[j
]);
572 GraphTraceLen
= LF_TRACE_BUFF_SIZE
;
574 uint8_t bits
[LF_BITSSTREAM_LEN
] = {0x00};
575 uint8_t * bitstream
= bits
;
576 manchester_decode(GraphBuffer
, LF_TRACE_BUFF_SIZE
, bitstream
, LF_BITSSTREAM_LEN
);
577 RepaintGraphWindow();
581 int CmdWriteWord(const char *Cmd
)
583 int Word
= 16; //default to invalid block
584 int Data
= 0xFFFFFFFF; //default to blank data
587 sscanf(Cmd
, "%x %d", &Data
, &Word
);
590 PrintAndLog("Word must be between 0 and 15");
594 PrintAndLog("Writting word %d with data %08X", Word
, Data
);
596 c
.cmd
= CMD_EM4X_WRITE_WORD
;
597 c
.d
.asBytes
[0] = 0x0; //Normal mode
605 int CmdWriteWordPWD(const char *Cmd
)
607 int Word
= 8; //default to invalid word
608 int Data
= 0xFFFFFFFF; //default to blank data
609 int Password
= 0xFFFFFFFF; //default to blank password
612 sscanf(Cmd
, "%x %d %x", &Data
, &Word
, &Password
);
615 PrintAndLog("Word must be between 0 and 15");
619 PrintAndLog("Writting word %d with data %08X and password %08X", Word
, Data
, Password
);
621 c
.cmd
= CMD_EM4X_WRITE_WORD
;
622 c
.d
.asBytes
[0] = 0x1; //Password mode
630 static command_t CommandTable
[] =
632 {"help", CmdHelp
, 1, "This help"},
633 {"410xread", CmdEM410xRead
, 1, "[clock rate] -- Extract ID from EM410x tag"},
634 {"410xsim", CmdEM410xSim
, 0, "<UID> -- Simulate EM410x tag"},
635 {"410xwatch", CmdEM410xWatch
, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"},
636 {"410xspoof", CmdEM410xWatchnSpoof
, 0, "['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)" },
637 {"410xwrite", CmdEM410xWrite
, 1, "<UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"},
638 {"4x50read", CmdEM4x50Read
, 1, "Extract data from EM4x50 tag"},
639 {"rd", CmdReadWord
, 1, "<Word 1-15> -- Read EM4xxx word data"},
640 {"rdpwd", CmdReadWordPWD
, 1, "<Word 1-15> <Password> -- Read EM4xxx word data in password mode "},
641 {"wr", CmdWriteWord
, 1, "<Data> <Word 1-15> -- Write EM4xxx word data"},
642 {"wrpwd", CmdWriteWordPWD
, 1, "<Data> <Word 1-15> <Password> -- Write EM4xxx word data in password mode"},
643 {NULL
, NULL
, 0, NULL
}
646 int CmdLFEM4X(const char *Cmd
)
648 CmdsParse(CommandTable
, Cmd
);
652 int CmdHelp(const char *Cmd
)
654 CmdsHelp(CommandTable
);