]>
cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfem4x.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // Low frequency EM4x commands
9 //-----------------------------------------------------------------------------
17 #include "cmdparser.h"
20 #include "cmdlfem4x.h"
22 static int CmdHelp(const char *Cmd
);
24 /* Read the ID of an EM410x tag.
26 * 1111 1111 1 <-- standard non-repeatable header
27 * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
29 * CCCC <-- each bit here is parity for the 10 bits above in corresponding column
30 * 0 <-- stop bit, end of tag
32 int CmdEM410xRead(const char *Cmd
)
34 int i
, j
, clock
, header
, rows
, bit
, hithigh
, hitlow
, first
, bit2idx
, high
, low
;
38 uint8_t BitStream
[MAX_GRAPH_TRACE_LEN
];
41 /* Detect high and lows and clock */
42 for (i
= 0; i
< GraphTraceLen
; i
++)
44 if (GraphBuffer
[i
] > high
)
45 high
= GraphBuffer
[i
];
46 else if (GraphBuffer
[i
] < low
)
51 clock
= GetClock(Cmd
, high
, 0);
53 /* parity for our 4 columns */
54 parity
[0] = parity
[1] = parity
[2] = parity
[3] = 0;
57 /* manchester demodulate */
59 for (i
= 0; i
< (int)(GraphTraceLen
/ clock
); i
++)
65 /* Find out if we hit both high and low peaks */
66 for (j
= 0; j
< clock
; j
++)
68 if (GraphBuffer
[(i
* clock
) + j
] == high
)
70 else if (GraphBuffer
[(i
* clock
) + j
] == low
)
73 /* it doesn't count if it's the first part of our read
74 because it's really just trailing from the last sequence */
75 if (first
&& (hithigh
|| hitlow
))
80 if (hithigh
&& hitlow
)
84 /* If we didn't hit both high and low peaks, we had a bit transition */
85 if (!hithigh
|| !hitlow
)
88 BitStream
[bit2idx
++] = bit
;
92 /* We go till 5 before the graph ends because we'll get that far below */
93 for (i
= 1; i
< bit2idx
- 5; i
++)
95 /* Step 2: We have our header but need our tag ID */
96 if (header
== 9 && rows
< 10)
98 /* Confirm parity is correct */
99 if ((BitStream
[i
] ^ BitStream
[i
+1] ^ BitStream
[i
+2] ^ BitStream
[i
+3]) == BitStream
[i
+4])
101 /* Read another byte! */
102 sprintf(id
+rows
, "%x", (8 * BitStream
[i
]) + (4 * BitStream
[i
+1]) + (2 * BitStream
[i
+2]) + (1 * BitStream
[i
+3]));
105 /* Keep parity info */
106 parity
[0] ^= BitStream
[i
];
107 parity
[1] ^= BitStream
[i
+1];
108 parity
[2] ^= BitStream
[i
+2];
109 parity
[3] ^= BitStream
[i
+3];
111 /* Move 4 bits ahead */
115 /* Damn, something wrong! reset */
118 PrintAndLog("Thought we had a valid tag but failed at word %d (i=%d)", rows
+ 1, i
);
120 /* Start back rows * 5 + 9 header bits, -1 to not start at same place */
121 i
-= 9 + (5 * rows
) - 5;
127 /* Step 3: Got our 40 bits! confirm column parity */
130 /* We need to make sure our 4 bits of parity are correct and we have a stop bit */
131 if (BitStream
[i
] == parity
[0] && BitStream
[i
+1] == parity
[1] &&
132 BitStream
[i
+2] == parity
[2] && BitStream
[i
+3] == parity
[3] &&
136 PrintAndLog("EM410x Tag ID: %s", id
);
142 /* Crap! Incorrect parity or no stop bit, start all over */
147 /* Go back 59 bits (9 header bits + 10 rows at 4+1 parity) */
152 /* Step 1: get our header */
155 /* Need 9 consecutive 1's */
156 if (BitStream
[i
] == 1)
159 /* We don't have a header, not enough consecutive 1 bits */
165 /* if we've already retested after flipping bits, return */
169 /* if this didn't work, try flipping bits */
170 for (i
= 0; i
< bit2idx
; i
++)
176 /* emulate an EM410X tag
178 * 1111 1111 1 <-- standard non-repeatable header
179 * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
181 * CCCC <-- each bit here is parity for the 10 bits above in corresponding column
182 * 0 <-- stop bit, end of tag
184 int CmdEM410xSim(const char *Cmd
)
186 int i
, n
, j
, h
, binary
[4], parity
[4];
188 /* clock is 64 in EM410x tags */
191 /* clear our graph */
194 /* write it out a few times */
195 for (h
= 0; h
< 4; h
++)
197 /* write 9 start bits */
198 for (i
= 0; i
< 9; i
++)
199 AppendGraph(0, clock
, 1);
201 /* for each hex char */
202 parity
[0] = parity
[1] = parity
[2] = parity
[3] = 0;
203 for (i
= 0; i
< 10; i
++)
205 /* read each hex char */
206 sscanf(&Cmd
[i
], "%1x", &n
);
207 for (j
= 3; j
>= 0; j
--, n
/= 2)
210 /* append each bit */
211 AppendGraph(0, clock
, binary
[0]);
212 AppendGraph(0, clock
, binary
[1]);
213 AppendGraph(0, clock
, binary
[2]);
214 AppendGraph(0, clock
, binary
[3]);
216 /* append parity bit */
217 AppendGraph(0, clock
, binary
[0] ^ binary
[1] ^ binary
[2] ^ binary
[3]);
219 /* keep track of column parity */
220 parity
[0] ^= binary
[0];
221 parity
[1] ^= binary
[1];
222 parity
[2] ^= binary
[2];
223 parity
[3] ^= binary
[3];
227 AppendGraph(0, clock
, parity
[0]);
228 AppendGraph(0, clock
, parity
[1]);
229 AppendGraph(0, clock
, parity
[2]);
230 AppendGraph(0, clock
, parity
[3]);
233 AppendGraph(0, clock
, 0);
236 /* modulate that biatch */
237 CmdManchesterMod("");
240 RepaintGraphWindow();
246 /* Function is equivalent of loread + losamples + em410xread
247 * looped until an EM410x tag is detected */
248 int CmdEM410xWatch(const char *Cmd
)
254 } while ( ! CmdEM410xRead(""));
258 /* Read the transmitted data of an EM4x50 tag
261 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
262 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
263 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
264 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
265 * CCCCCCCC <- column parity bits
267 * LW <- Listen Window
269 * This pattern repeats for every block of data being transmitted.
270 * Transmission starts with two Listen Windows (LW - a modulated
271 * pattern of 320 cycles each (32/32/128/64/64)).
273 * Note that this data may or may not be the UID. It is whatever data
274 * is stored in the blocks defined in the control word First and Last
275 * Word Read values. UID is stored in block 32.
277 int CmdEM4x50Read(const char *Cmd
)
279 int i
, j
, startblock
, skip
, block
, start
, end
, low
, high
;
280 bool complete
= false;
281 int tmpbuff
[MAX_GRAPH_TRACE_LEN
/ 64];
285 memset(tmpbuff
, 0, MAX_GRAPH_TRACE_LEN
/ 64);
287 /* first get high and low values */
288 for (i
= 0; i
< GraphTraceLen
; i
++)
290 if (GraphBuffer
[i
] > high
)
291 high
= GraphBuffer
[i
];
292 else if (GraphBuffer
[i
] < low
)
293 low
= GraphBuffer
[i
];
296 /* populate a buffer with pulse lengths */
299 while (i
< GraphTraceLen
)
301 // measure from low to low
302 while ((GraphBuffer
[i
] > low
) && (i
<GraphTraceLen
))
305 while ((GraphBuffer
[i
] < high
) && (i
<GraphTraceLen
))
307 while ((GraphBuffer
[i
] > low
) && (i
<GraphTraceLen
))
309 if (j
>(MAX_GRAPH_TRACE_LEN
/64)) {
312 tmpbuff
[j
++]= i
- start
;
315 /* look for data start - should be 2 pairs of LW (pulses of 192,128) */
318 for (i
= 0; i
< j
- 4 ; ++i
)
321 if (tmpbuff
[i
] >= 190 && tmpbuff
[i
] <= 194)
322 if (tmpbuff
[i
+1] >= 126 && tmpbuff
[i
+1] <= 130)
323 if (tmpbuff
[i
+2] >= 190 && tmpbuff
[i
+2] <= 194)
324 if (tmpbuff
[i
+3] >= 126 && tmpbuff
[i
+3] <= 130)
332 /* skip over the remainder of the LW */
333 skip
+= tmpbuff
[i
+1]+tmpbuff
[i
+2];
334 while (skip
< MAX_GRAPH_TRACE_LEN
&& GraphBuffer
[skip
] > low
)
338 /* now do it again to find the end */
340 for (i
+= 3; i
< j
- 4 ; ++i
)
343 if (tmpbuff
[i
] >= 190 && tmpbuff
[i
] <= 194)
344 if (tmpbuff
[i
+1] >= 126 && tmpbuff
[i
+1] <= 130)
345 if (tmpbuff
[i
+2] >= 190 && tmpbuff
[i
+2] <= 194)
346 if (tmpbuff
[i
+3] >= 126 && tmpbuff
[i
+3] <= 130)
354 PrintAndLog("Found data at sample: %i",skip
);
357 PrintAndLog("No data found!");
358 PrintAndLog("Try again with more samples.");
364 PrintAndLog("*** Warning!");
365 PrintAndLog("Partial data - no end found!");
366 PrintAndLog("Try again with more samples.");
369 /* get rid of leading crap */
370 sprintf(tmp
,"%i",skip
);
373 /* now work through remaining buffer printing out data blocks */
378 PrintAndLog("Block %i:", block
);
379 // mandemod routine needs to be split so we can call it for data
380 // just print for now for debugging
381 CmdManchesterDemod("i 64");
383 /* look for LW before start of next block */
384 for ( ; i
< j
- 4 ; ++i
)
387 if (tmpbuff
[i
] >= 190 && tmpbuff
[i
] <= 194)
388 if (tmpbuff
[i
+1] >= 126 && tmpbuff
[i
+1] <= 130)
391 while (GraphBuffer
[skip
] > low
)
394 sprintf(tmp
,"%i",skip
);
402 int CmdEM410xWrite(const char *Cmd
)
407 sscanf(Cmd
, "%" PRIx64
" %d", &id
, &card
);
409 if (id
>= 0x10000000000) {
410 PrintAndLog("Error! Given EM410x ID is longer than 40 bits.\n");
415 PrintAndLog("Error! Bad card type selected.\n");
419 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64
, card
? "T55x7":"T5555", id
);
420 UsbCommand c
= {CMD_EM410X_WRITE_TAG
, {card
, (uint32_t)(id
>> 32), (uint32_t)id
}};
426 static command_t CommandTable
[] =
428 {"help", CmdHelp
, 1, "This help"},
429 {"em410xread", CmdEM410xRead
, 1, "[clock rate] -- Extract ID from EM410x tag"},
430 {"em410xsim", CmdEM410xSim
, 0, "<UID> -- Simulate EM410x tag"},
431 {"em410xwatch", CmdEM410xWatch
, 0, "Watches for EM410x tags"},
432 {"em410xwrite", CmdEM410xWrite
, 1, "<UID> <'0' T5555> <'1' T55x7> -- Write EM410x UID to T5555(Q5) or T55x7 tag"},
433 {"em4x50read", CmdEM4x50Read
, 1, "Extract data from EM4x50 tag"},
434 {NULL
, NULL
, 0, NULL
}
437 int CmdLFEM4X(const char *Cmd
)
439 CmdsParse(CommandTable
, Cmd
);
443 int CmdHelp(const char *Cmd
)
445 CmdsHelp(CommandTable
);