1 //-----------------------------------------------------------------------------
3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
4 // at your option, any later version. See the LICENSE.txt file for the text of
6 //-----------------------------------------------------------------------------
7 // Low frequency T55xx commands
8 //-----------------------------------------------------------------------------
14 #include "proxmark3.h"
18 #include "cmdparser.h"
21 #include "cmdlft55xx.h"
25 #include "../common/crc.h"
26 #include "../common/iso14443crc.h"
29 #define CONFIGURATION_BLOCK 0x00
30 #define TRACE_BLOCK 0x01
31 #define REGULAR_READ_MODE_BLOCK 0xFF
33 // Default configuration
34 t55xx_conf_block_t config
= { .modulation
= DEMOD_ASK
, .inverted
= FALSE
, .offset
= 0x00, .block0
= 0x00, .Q5
= FALSE
};
36 t55xx_conf_block_t
Get_t55xx_Config(){
39 void Set_t55xx_Config(t55xx_conf_block_t conf
){
43 int usage_t55xx_config(){
44 PrintAndLog("Usage: lf t55xx config [d <demodulation>] [i 1] [o <offset>] [Q5]");
45 PrintAndLog("Options:");
46 PrintAndLog(" h This help");
47 PrintAndLog(" b <8|16|32|40|50|64|100|128> Set bitrate");
48 PrintAndLog(" d <FSK|FSK1|FSK1a|FSK2|FSK2a|ASK|PSK1|PSK2|NRZ|BI|BIa> Set demodulation FSK / ASK / PSK / NRZ / Biphase / Biphase A");
49 PrintAndLog(" i [1] Invert data signal, defaults to normal");
50 PrintAndLog(" o [offset] Set offset, where data should start decode in bitstream");
51 PrintAndLog(" Q5 Set as Q5(T5555) chip instead of T55x7");
53 PrintAndLog("Examples:");
54 PrintAndLog(" lf t55xx config d FSK - FSK demodulation");
55 PrintAndLog(" lf t55xx config d FSK i 1 - FSK demodulation, inverse data");
56 PrintAndLog(" lf t55xx config d FSK i 1 o 3 - FSK demodulation, inverse data, offset=3,start from position 3 to decode data");
60 int usage_t55xx_read(){
61 PrintAndLog("Usage: lf t55xx read [b <block>] [p <password>] <override_safety> <page1>");
62 PrintAndLog("Options:");
63 PrintAndLog(" b <block> - block number to read. Between 0-7");
64 PrintAndLog(" p <password> - OPTIONAL password (8 hex characters)");
65 PrintAndLog(" o - OPTIONAL override safety check");
66 PrintAndLog(" 1 - OPTIONAL read Page 1 instead of Page 0");
67 PrintAndLog(" ****WARNING****");
68 PrintAndLog(" Use of read with password on a tag not configured for a pwd");
69 PrintAndLog(" can damage the tag");
71 PrintAndLog("Examples:");
72 PrintAndLog(" lf t55xx read b 0 - read data from block 0");
73 PrintAndLog(" lf t55xx read b 0 p feedbeef - read data from block 0 password feedbeef");
74 PrintAndLog(" lf t55xx read b 0 p feedbeef o - read data from block 0 password feedbeef safety check");
78 int usage_t55xx_write(){
79 PrintAndLog("Usage: lf t55xx wr [b <block>] [d <data>] [p <password>] [1]");
80 PrintAndLog("Options:");
81 PrintAndLog(" b <block> - block number to write. Between 0-7");
82 PrintAndLog(" d <data> - 4 bytes of data to write (8 hex characters)");
83 PrintAndLog(" p <password> - OPTIONAL password 4bytes (8 hex characters)");
84 PrintAndLog(" 1 - OPTIONAL write Page 1 instead of Page 0");
86 PrintAndLog("Examples:");
87 PrintAndLog(" lf t55xx wr b 3 d 11223344 - write 11223344 to block 3");
88 PrintAndLog(" lf t55xx wr b 3 d 11223344 p feedbeef - write 11223344 to block 3 password feedbeef");
92 int usage_t55xx_trace() {
93 PrintAndLog("Usage: lf t55xx trace [1]");
94 PrintAndLog("Options:");
95 PrintAndLog(" [graph buffer data] - if set, use Graphbuffer otherwise read data from tag.");
97 PrintAndLog("Examples:");
98 PrintAndLog(" lf t55xx trace");
99 PrintAndLog(" lf t55xx trace 1");
103 int usage_t55xx_info() {
104 PrintAndLog("Usage: lf t55xx info [1]");
105 PrintAndLog("Options:");
106 PrintAndLog(" [graph buffer data] - if set, use Graphbuffer otherwise read data from tag.");
108 PrintAndLog("Examples:");
109 PrintAndLog(" lf t55xx info");
110 PrintAndLog(" lf t55xx info 1");
114 int usage_t55xx_dump(){
115 PrintAndLog("Usage: lf t55xx dump <password> [o]");
116 PrintAndLog("Options:");
117 PrintAndLog(" <password> - OPTIONAL password 4bytes (8 hex symbols)");
118 PrintAndLog(" o - OPTIONAL override, force pwd read despite danger to card");
120 PrintAndLog("Examples:");
121 PrintAndLog(" lf t55xx dump");
122 PrintAndLog(" lf t55xx dump feedbeef o");
126 int usage_t55xx_detect(){
127 PrintAndLog("Usage: lf t55xx detect [1]");
128 PrintAndLog("Options:");
129 PrintAndLog(" [graph buffer data] - if set, use Graphbuffer otherwise read data from tag.");
131 PrintAndLog("Examples:");
132 PrintAndLog(" lf t55xx detect");
133 PrintAndLog(" lf t55xx detect 1");
137 int usage_t55xx_wakup(){
138 PrintAndLog("Usage: lf t55xx wakeup [h] p <password>");
139 PrintAndLog("This commands send the Answer-On-Request command and leaves the readerfield ON afterwards.");
140 PrintAndLog("Options:");
141 PrintAndLog(" h - this help");
142 PrintAndLog(" p <password> - password 4bytes (8 hex symbols)");
144 PrintAndLog("Examples:");
145 PrintAndLog(" lf t55xx wakeup p 11223344 - send wakeup password");
149 static int CmdHelp(const char *Cmd
);
151 int CmdT55xxSetConfig(const char *Cmd
) {
154 char modulation
[5] = {0x00};
157 uint8_t rates
[9] = {8,16,32,40,50,64,100,128,0};
161 while(param_getchar(Cmd
, cmdp
) != 0x00 && !errors
)
163 tmp
= param_getchar(Cmd
, cmdp
);
168 return usage_t55xx_config();
170 errors
|= param_getdec(Cmd
, cmdp
+1, &bitRate
);
174 if (rates
[i
]==bitRate
) {
179 if (i
==9) errors
= TRUE
;
184 param_getstr(Cmd
, cmdp
+1, modulation
);
187 if ( strcmp(modulation
, "FSK" ) == 0) {
188 config
.modulation
= DEMOD_FSK
;
189 } else if ( strcmp(modulation
, "FSK1" ) == 0) {
190 config
.modulation
= DEMOD_FSK1
;
192 } else if ( strcmp(modulation
, "FSK1a" ) == 0) {
193 config
.modulation
= DEMOD_FSK1a
;
195 } else if ( strcmp(modulation
, "FSK2" ) == 0) {
196 config
.modulation
= DEMOD_FSK2
;
198 } else if ( strcmp(modulation
, "FSK2a" ) == 0) {
199 config
.modulation
= DEMOD_FSK2a
;
201 } else if ( strcmp(modulation
, "ASK" ) == 0) {
202 config
.modulation
= DEMOD_ASK
;
203 } else if ( strcmp(modulation
, "NRZ" ) == 0) {
204 config
.modulation
= DEMOD_NRZ
;
205 } else if ( strcmp(modulation
, "PSK1" ) == 0) {
206 config
.modulation
= DEMOD_PSK1
;
207 } else if ( strcmp(modulation
, "PSK2" ) == 0) {
208 config
.modulation
= DEMOD_PSK2
;
209 } else if ( strcmp(modulation
, "PSK3" ) == 0) {
210 config
.modulation
= DEMOD_PSK3
;
211 } else if ( strcmp(modulation
, "BIa" ) == 0) {
212 config
.modulation
= DEMOD_BIa
;
214 } else if ( strcmp(modulation
, "BI" ) == 0) {
215 config
.modulation
= DEMOD_BI
;
218 PrintAndLog("Unknown modulation '%s'", modulation
);
223 config
.inverted
= param_getchar(Cmd
,cmdp
+1) == '1';
227 errors
|= param_getdec(Cmd
, cmdp
+1, &offset
);
229 config
.offset
= offset
;
238 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
245 if (cmdp
== 0) return printConfiguration( config
);
248 if (errors
) return usage_t55xx_config();
251 return printConfiguration ( config
);
254 int T55xxReadBlock(uint8_t block
, bool page1
, bool usepwd
, bool override
, uint32_t password
){
257 // try reading the config block and verify that PWD bit is set before doing this!
259 if ( !AquireData(0, CONFIGURATION_BLOCK
, false, 0 ) ) return 0;
260 if ( !tryDetectModulation() ) {
261 PrintAndLog("Safety Check: Could not detect if PWD bit is set in config block. Exits.");
264 PrintAndLog("Safety Check: PWD bit is NOT set in config block. Reading without password...");
269 PrintAndLog("Safety Check Overriden - proceeding despite risk");
273 if (!AquireData(page1
, block
, usepwd
, password
) ) return 0;
274 if (!DecodeT55xxBlock()) return 0;
277 sprintf(blk
,"%d", block
);
278 printT55xxBlock(blk
);
282 int CmdT55xxReadBlock(const char *Cmd
) {
283 uint8_t block
= REGULAR_READ_MODE_BLOCK
;
284 uint32_t password
= 0; //default to blank Block 7
286 bool override
= false;
290 while(param_getchar(Cmd
, cmdp
) != 0x00 && !errors
) {
291 switch(param_getchar(Cmd
, cmdp
)) {
294 return usage_t55xx_read();
297 errors
|= param_getdec(Cmd
, cmdp
+1, &block
);
307 password
= param_get32ex(Cmd
, cmdp
+1, 0, 16);
316 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
321 if (errors
) return usage_t55xx_read();
323 if (block
> 7 && block
!= REGULAR_READ_MODE_BLOCK
) {
324 PrintAndLog("Block must be between 0 and 7");
327 PrintAndLog("Reading Page %d:", page1
);
328 PrintAndLog("blk | hex data | binary");
329 return T55xxReadBlock(block
, page1
, usepwd
, override
, password
);
332 bool DecodeT55xxBlock(){
334 char buf
[30] = {0x00};
337 uint8_t bitRate
[8] = {8,16,32,40,50,64,100,128};
338 DemodBufferLen
= 0x00;
340 switch( config
.modulation
){
342 snprintf(cmdStr
, sizeof(buf
),"%d %d", bitRate
[config
.bitrate
], config
.inverted
);
343 ans
= FSKrawDemod(cmdStr
, FALSE
);
347 snprintf(cmdStr
, sizeof(buf
),"%d %d 8 5", bitRate
[config
.bitrate
], config
.inverted
);
348 ans
= FSKrawDemod(cmdStr
, FALSE
);
352 snprintf(cmdStr
, sizeof(buf
),"%d %d 10 8", bitRate
[config
.bitrate
], config
.inverted
);
353 ans
= FSKrawDemod(cmdStr
, FALSE
);
356 snprintf(cmdStr
, sizeof(buf
),"%d %d 0", bitRate
[config
.bitrate
], config
.inverted
);
357 ans
= ASKDemod(cmdStr
, FALSE
, FALSE
, 1);
360 snprintf(cmdStr
, sizeof(buf
),"%d %d 0", bitRate
[config
.bitrate
], config
.inverted
);
361 ans
= PSKDemod(cmdStr
, FALSE
);
363 case DEMOD_PSK2
: //inverted won't affect this
364 case DEMOD_PSK3
: //not fully implemented
365 snprintf(cmdStr
, sizeof(buf
),"%d 0 1", bitRate
[config
.bitrate
] );
366 ans
= PSKDemod(cmdStr
, FALSE
);
367 psk1TOpsk2(DemodBuffer
, DemodBufferLen
);
370 snprintf(cmdStr
, sizeof(buf
),"%d %d 1", bitRate
[config
.bitrate
], config
.inverted
);
371 ans
= NRZrawDemod(cmdStr
, FALSE
);
375 snprintf(cmdStr
, sizeof(buf
),"0 %d %d 0", bitRate
[config
.bitrate
], config
.inverted
);
376 ans
= ASKbiphaseDemod(cmdStr
, FALSE
);
384 int CmdT55xxDetect(const char *Cmd
){
386 char cmdp
= param_getchar(Cmd
, 0);
387 if (strlen(Cmd
) > 1 || cmdp
== 'h' || cmdp
== 'H')
388 return usage_t55xx_detect();
391 if ( !AquireData(0, CONFIGURATION_BLOCK
, false, 0) )
394 if ( !tryDetectModulation() )
395 PrintAndLog("Could not detect modulation automatically. Try setting it manually with \'lf t55xx config\'");
400 // detect configuration?
401 bool tryDetectModulation(){
403 t55xx_conf_block_t tests
[15];
405 uint8_t fc1
= 0, fc2
= 0, clk
=0;
407 if (GetFskClock("", FALSE
, FALSE
)){
408 fskClocks(&fc1
, &fc2
, &clk
, FALSE
);
409 if ( FSKrawDemod("0 0", FALSE
) && test(DEMOD_FSK
, &tests
[hits
].offset
, &bitRate
, clk
, &tests
[hits
].Q5
)){
410 tests
[hits
].modulation
= DEMOD_FSK
;
411 if (fc1
==8 && fc2
== 5)
412 tests
[hits
].modulation
= DEMOD_FSK1a
;
413 else if (fc1
==10 && fc2
== 8)
414 tests
[hits
].modulation
= DEMOD_FSK2
;
415 tests
[hits
].bitrate
= bitRate
;
416 tests
[hits
].inverted
= FALSE
;
417 tests
[hits
].block0
= PackBits(tests
[hits
].offset
, 32, DemodBuffer
);
420 if ( FSKrawDemod("0 1", FALSE
) && test(DEMOD_FSK
, &tests
[hits
].offset
, &bitRate
, clk
, &tests
[hits
].Q5
)) {
421 tests
[hits
].modulation
= DEMOD_FSK
;
422 if (fc1
== 8 && fc2
== 5)
423 tests
[hits
].modulation
= DEMOD_FSK1
;
424 else if (fc1
== 10 && fc2
== 8)
425 tests
[hits
].modulation
= DEMOD_FSK2a
;
427 tests
[hits
].bitrate
= bitRate
;
428 tests
[hits
].inverted
= TRUE
;
429 tests
[hits
].block0
= PackBits(tests
[hits
].offset
, 32, DemodBuffer
);
433 clk
= GetAskClock("", FALSE
, FALSE
);
435 if ( ASKDemod("0 0 0", FALSE
, FALSE
, 1) && test(DEMOD_ASK
, &tests
[hits
].offset
, &bitRate
, clk
, &tests
[hits
].Q5
)) {
436 tests
[hits
].modulation
= DEMOD_ASK
;
437 tests
[hits
].bitrate
= bitRate
;
438 tests
[hits
].inverted
= FALSE
;
439 tests
[hits
].block0
= PackBits(tests
[hits
].offset
, 32, DemodBuffer
);
442 if ( ASKDemod("0 1 0", FALSE
, FALSE
, 1) && test(DEMOD_ASK
, &tests
[hits
].offset
, &bitRate
, clk
, &tests
[hits
].Q5
)) {
443 tests
[hits
].modulation
= DEMOD_ASK
;
444 tests
[hits
].bitrate
= bitRate
;
445 tests
[hits
].inverted
= TRUE
;
446 tests
[hits
].block0
= PackBits(tests
[hits
].offset
, 32, DemodBuffer
);
449 if ( ASKbiphaseDemod("0 0 0 0", FALSE
) && test(DEMOD_BI
, &tests
[hits
].offset
, &bitRate
, clk
, &tests
[hits
].Q5
) ) {
450 tests
[hits
].modulation
= DEMOD_BI
;
451 tests
[hits
].bitrate
= bitRate
;
452 tests
[hits
].inverted
= FALSE
;
453 tests
[hits
].block0
= PackBits(tests
[hits
].offset
, 32, DemodBuffer
);
456 if ( ASKbiphaseDemod("0 0 1 0", FALSE
) && test(DEMOD_BIa
, &tests
[hits
].offset
, &bitRate
, clk
, &tests
[hits
].Q5
) ) {
457 tests
[hits
].modulation
= DEMOD_BIa
;
458 tests
[hits
].bitrate
= bitRate
;
459 tests
[hits
].inverted
= TRUE
;
460 tests
[hits
].block0
= PackBits(tests
[hits
].offset
, 32, DemodBuffer
);
466 clk
= GetNrzClock("", FALSE
, FALSE
);
468 if ( NRZrawDemod("0 0 1", FALSE
) && test(DEMOD_NRZ
, &tests
[hits
].offset
, &bitRate
, clk
, &tests
[hits
].Q5
)) {
469 tests
[hits
].modulation
= DEMOD_NRZ
;
470 tests
[hits
].bitrate
= bitRate
;
471 tests
[hits
].inverted
= FALSE
;
472 tests
[hits
].block0
= PackBits(tests
[hits
].offset
, 32, DemodBuffer
);
476 if ( NRZrawDemod("0 1 1", FALSE
) && test(DEMOD_NRZ
, &tests
[hits
].offset
, &bitRate
, clk
, &tests
[hits
].Q5
)) {
477 tests
[hits
].modulation
= DEMOD_NRZ
;
478 tests
[hits
].bitrate
= bitRate
;
479 tests
[hits
].inverted
= TRUE
;
480 tests
[hits
].block0
= PackBits(tests
[hits
].offset
, 32, DemodBuffer
);
487 clk
= GetPskClock("", FALSE
, FALSE
);
489 if ( PSKDemod("0 0 1", FALSE
) && test(DEMOD_PSK1
, &tests
[hits
].offset
, &bitRate
, clk
, &tests
[hits
].Q5
)) {
490 tests
[hits
].modulation
= DEMOD_PSK1
;
491 tests
[hits
].bitrate
= bitRate
;
492 tests
[hits
].inverted
= FALSE
;
493 tests
[hits
].block0
= PackBits(tests
[hits
].offset
, 32, DemodBuffer
);
496 if ( PSKDemod("0 1 1", FALSE
) && test(DEMOD_PSK1
, &tests
[hits
].offset
, &bitRate
, clk
, &tests
[hits
].Q5
)) {
497 tests
[hits
].modulation
= DEMOD_PSK1
;
498 tests
[hits
].bitrate
= bitRate
;
499 tests
[hits
].inverted
= TRUE
;
500 tests
[hits
].block0
= PackBits(tests
[hits
].offset
, 32, DemodBuffer
);
503 // PSK2 - needs a call to psk1TOpsk2.
504 if ( PSKDemod("0 0 1", FALSE
)) {
505 psk1TOpsk2(DemodBuffer
, DemodBufferLen
);
506 if (test(DEMOD_PSK2
, &tests
[hits
].offset
, &bitRate
, clk
, &tests
[hits
].Q5
)){
507 tests
[hits
].modulation
= DEMOD_PSK2
;
508 tests
[hits
].bitrate
= bitRate
;
509 tests
[hits
].inverted
= FALSE
;
510 tests
[hits
].block0
= PackBits(tests
[hits
].offset
, 32, DemodBuffer
);
513 } // inverse waves does not affect this demod
514 // PSK3 - needs a call to psk1TOpsk2.
515 if ( PSKDemod("0 0 1", FALSE
)) {
516 psk1TOpsk2(DemodBuffer
, DemodBufferLen
);
517 if (test(DEMOD_PSK3
, &tests
[hits
].offset
, &bitRate
, clk
, &tests
[hits
].Q5
)){
518 tests
[hits
].modulation
= DEMOD_PSK3
;
519 tests
[hits
].bitrate
= bitRate
;
520 tests
[hits
].inverted
= FALSE
;
521 tests
[hits
].block0
= PackBits(tests
[hits
].offset
, 32, DemodBuffer
);
524 } // inverse waves does not affect this demod
528 config
.modulation
= tests
[0].modulation
;
529 config
.bitrate
= tests
[0].bitrate
;
530 config
.inverted
= tests
[0].inverted
;
531 config
.offset
= tests
[0].offset
;
532 config
.block0
= tests
[0].block0
;
533 printConfiguration( config
);
538 PrintAndLog("Found [%d] possible matches for modulation.",hits
);
539 for(int i
=0; i
<hits
; ++i
){
540 PrintAndLog("--[%d]---------------", i
+1);
541 printConfiguration( tests
[i
] );
547 bool testModulation(uint8_t mode
, uint8_t modread
){
550 if (modread
>= DEMOD_FSK1
&& modread
<= DEMOD_FSK2a
) return TRUE
;
553 if (modread
== DEMOD_ASK
) return TRUE
;
556 if (modread
== DEMOD_PSK1
) return TRUE
;
559 if (modread
== DEMOD_PSK2
) return TRUE
;
562 if (modread
== DEMOD_PSK3
) return TRUE
;
565 if (modread
== DEMOD_NRZ
) return TRUE
;
568 if (modread
== DEMOD_BI
) return TRUE
;
571 if (modread
== DEMOD_BIa
) return TRUE
;
579 bool testQ5Modulation(uint8_t mode
, uint8_t modread
){
582 if (modread
>= 4 && modread
<= 5) return TRUE
;
585 if (modread
== 0) return TRUE
;
588 if (modread
== 1) return TRUE
;
591 if (modread
== 2) return TRUE
;
594 if (modread
== 3) return TRUE
;
597 if (modread
== 7) return TRUE
;
600 if (modread
== 6) return TRUE
;
608 bool testQ5(uint8_t mode
, uint8_t *offset
, int *fndBitRate
, uint8_t clk
){
610 if ( DemodBufferLen
< 64 ) return FALSE
;
612 for (uint8_t idx
= 0; idx
< 64; idx
++){
614 if ( PackBits(si
, 32, DemodBuffer
) == 0x00 ) continue;
616 uint8_t safer
= PackBits(si
, 4, DemodBuffer
); si
+= 4; //master key
617 uint8_t resv
= PackBits(si
, 8, DemodBuffer
); si
+= 8;
618 // 2nibble must be zeroed.
619 // moved test to here, since this gets most faults first.
620 if (safer
!= 0x6) continue;
621 if ( resv
> 0x00) continue;
622 //uint8_t pageSel = PackBits(si, 1, DemodBuffer); si += 1;
623 //uint8_t fastWrite = PackBits(si, 1, DemodBuffer); si += 1;
625 int bitRate
= PackBits(si
, 5, DemodBuffer
)*2 + 2; si
+= 5; //bit rate
626 if (bitRate
> 128) continue;
629 //uint8_t AOR = PackBits(si, 1, DemodBuffer); si += 1; //bit 15 extended mode
630 //uint8_t PWD = PackBits(si, 1, DemodBuffer); si += 1;
631 //uint8_t pskcr = PackBits(si, 2, DemodBuffer); si += 2; //could check psk cr
632 //uint8_t inverse = PackBits(si, 1, DemodBuffer); si += 1;
633 uint8_t modread
= PackBits(si
, 3, DemodBuffer
); si
+= 3; //bit 24, 30, 31 could be tested for 0 if not extended mode
634 //uint8_t maxBlk = PackBits(si, 2, DemodBuffer); si += 2;
635 //uint8_t ST = PackBits(si, 1, DemodBuffer); si += 1;
638 if (!testQ5Modulation(mode
, modread
)) continue;
639 if (bitRate
!= clk
) continue;
640 *fndBitRate
= bitRate
;
648 bool testBitRate(uint8_t readRate
, uint8_t clk
){
649 uint8_t expected
[8] = {8, 16, 32, 40, 50, 64, 100, 128};
650 if (expected
[readRate
] == clk
)
656 bool test(uint8_t mode
, uint8_t *offset
, int *fndBitRate
, uint8_t clk
, bool *Q5
){
658 if ( DemodBufferLen
< 64 ) return FALSE
;
660 for (uint8_t idx
= 0; idx
< 64; idx
++){
662 if ( PackBits(si
, 32, DemodBuffer
) == 0x00 ) continue;
664 uint8_t safer
= PackBits(si
, 4, DemodBuffer
); si
+= 4; //master key
665 uint8_t resv
= PackBits(si
, 4, DemodBuffer
); si
+= 4; //was 7 & +=7+3 //should be only 4 bits if extended mode
666 // 2nibble must be zeroed.
667 // moved test to here, since this gets most faults first.
668 if ( resv
> 0x00) continue;
670 uint8_t xtRate
= PackBits(si
, 3, DemodBuffer
); si
+= 3; //extended mode part of rate
671 int bitRate
= PackBits(si
, 3, DemodBuffer
); si
+= 3; //bit rate
672 if (bitRate
> 7) continue;
673 uint8_t extend
= PackBits(si
, 1, DemodBuffer
); si
+= 1; //bit 15 extended mode
674 uint8_t modread
= PackBits(si
, 5, DemodBuffer
); si
+= 5+2+1;
675 //uint8_t pskcr = PackBits(si, 2, DemodBuffer); si += 2+1; //could check psk cr
676 uint8_t nml01
= PackBits(si
, 1, DemodBuffer
); si
+= 1+5; //bit 24, 30, 31 could be tested for 0 if not extended mode
677 uint8_t nml02
= PackBits(si
, 2, DemodBuffer
); si
+= 2;
680 bool extMode
=( (safer
== 0x6 || safer
== 0x9) && extend
) ? TRUE
: FALSE
;
683 if (nml01
|| nml02
|| xtRate
) continue;
686 if (!testModulation(mode
, modread
)) continue;
687 if (!testBitRate(bitRate
, clk
)) continue;
688 *fndBitRate
= bitRate
;
693 if (testQ5(mode
, offset
, fndBitRate
, clk
)) {
700 void printT55xxBlock(const char *blockNum
){
702 uint8_t i
= config
.offset
;
703 uint8_t endpos
= 32 + i
;
704 uint32_t blockData
= 0;
705 uint8_t bits
[64] = {0x00};
707 if ( !DemodBufferLen
) return;
709 if ( endpos
> DemodBufferLen
){
710 PrintAndLog("The configured offset %d is too big. Possible offset: %d)", i
, DemodBufferLen
-32);
714 for (; i
< endpos
; ++i
)
715 bits
[i
- config
.offset
]=DemodBuffer
[i
];
717 blockData
= PackBits(0, 32, bits
);
718 PrintAndLog(" %s | %08X | %s", blockNum
, blockData
, sprint_bin(bits
,32));
721 int special(const char *Cmd
) {
722 uint32_t blockData
= 0;
723 uint8_t bits
[32] = {0x00};
725 PrintAndLog("OFFSET | DATA | BINARY");
726 PrintAndLog("----------------------------------------------------");
730 for (i
= 0; i
< 32; ++i
)
731 bits
[i
]=DemodBuffer
[j
+i
];
733 blockData
= PackBits(0, 32, bits
);
735 PrintAndLog(" %02d | 0x%08X | %s",j
, blockData
, sprint_bin(bits
,32));
740 int printConfiguration( t55xx_conf_block_t b
){
741 PrintAndLog("Chip Type : %s", (b
.Q5
) ? "T5555(Q5)" : "T55x7");
742 PrintAndLog("Modulation : %s", GetSelectedModulationStr(b
.modulation
) );
743 PrintAndLog("Bit Rate : %s", GetBitRateStr(b
.bitrate
) );
744 PrintAndLog("Inverted : %s", (b
.inverted
) ? "Yes" : "No" );
745 PrintAndLog("Offset : %d", b
.offset
);
746 PrintAndLog("Block0 : 0x%08X", b
.block0
);
751 int CmdT55xxWakeUp(const char *Cmd
) {
752 uint32_t password
= 0;
755 while(param_getchar(Cmd
, cmdp
) != 0x00) {
756 switch(param_getchar(Cmd
, cmdp
)) {
759 return usage_t55xx_wakup();
762 password
= param_get32ex(Cmd
, cmdp
+1, 0xFFFFFFFF, 16);
767 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
772 if (errors
) return usage_t55xx_wakup();
774 UsbCommand c
= {CMD_T55XX_WAKEUP
, {password
, 0, 0}};
775 clearCommandBuffer();
777 PrintAndLog("Wake up command sent. Try read now");
781 int CmdT55xxWriteBlock(const char *Cmd
) {
782 uint8_t block
= 0xFF; //default to invalid block
783 uint32_t data
= 0xFFFFFFFF; //default to blank Block
784 uint32_t password
= 0xFFFFFFFF; //default to blank Block 7
787 bool gotdata
= false;
790 while(param_getchar(Cmd
, cmdp
) != 0x00 && !errors
) {
791 switch(param_getchar(Cmd
, cmdp
)) {
794 return usage_t55xx_write();
797 errors
|= param_getdec(Cmd
, cmdp
+1, &block
);
802 data
= param_get32ex(Cmd
, cmdp
+1, 0, 16);
808 password
= param_get32ex(Cmd
, cmdp
+1, 0, 16);
817 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
822 if (errors
|| !gotdata
) return usage_t55xx_write();
825 PrintAndLog("Block number must be between 0 and 7");
829 UsbCommand c
= {CMD_T55XX_WRITE_BLOCK
, {data
, block
, 0}};
831 c
.d
.asBytes
[0] = (page1
) ? 0x2 : 0;
833 PrintAndLog("Writing to page: %d block: %d data : 0x%08X", page1
, block
, data
);
838 c
.d
.asBytes
[0] |= 0x1;
839 PrintAndLog("pwd : 0x%08X", password
);
841 clearCommandBuffer();
843 if (!WaitForResponseTimeout(CMD_ACK
, &resp
, 1000)){
844 PrintAndLog("Error occurred, device did not ACK write operation. (May be due to old firmware)");
850 int CmdT55xxReadTrace(const char *Cmd
) {
851 char cmdp
= param_getchar(Cmd
, 0);
852 bool pwdmode
= false;
853 uint32_t password
= 0;
854 if (strlen(Cmd
) > 1 || cmdp
== 'h' || cmdp
== 'H')
855 return usage_t55xx_trace();
858 if ( !AquireData( TRACE_BLOCK
, REGULAR_READ_MODE_BLOCK
, pwdmode
, password
) )
861 if (!DecodeT55xxBlock()) return 0;
863 if ( !DemodBufferLen
) return 0;
865 RepaintGraphWindow();
867 if (config
.offset
> 5)
869 uint8_t si
= config
.offset
+repeat
;
870 uint32_t bl1
= PackBits(si
, 32, DemodBuffer
);
871 uint32_t bl2
= PackBits(si
+32, 32, DemodBuffer
);
873 uint32_t acl
= PackBits(si
, 8, DemodBuffer
); si
+= 8;
874 uint32_t mfc
= PackBits(si
, 8, DemodBuffer
); si
+= 8;
875 uint32_t cid
= PackBits(si
, 5, DemodBuffer
); si
+= 5;
876 uint32_t icr
= PackBits(si
, 3, DemodBuffer
); si
+= 3;
877 uint32_t year
= PackBits(si
, 4, DemodBuffer
); si
+= 4;
878 uint32_t quarter
= PackBits(si
, 2, DemodBuffer
); si
+= 2;
879 uint32_t lotid
= PackBits(si
, 14, DemodBuffer
); si
+= 14;
880 uint32_t wafer
= PackBits(si
, 5, DemodBuffer
); si
+= 5;
881 uint32_t dw
= PackBits(si
, 15, DemodBuffer
);
883 time_t t
= time(NULL
);
884 struct tm tm
= *localtime(&t
);
885 if ( year
> tm
.tm_year
-110)
890 if (config
.Q5
) PrintAndLog("*** Warning *** Info read off a Q5 will not work as expected");
892 PrintAndLog("The modulation is most likely wrong since the ACL is not 0xE0. ");
896 PrintAndLog("-- T55xx Trace Information ----------------------------------");
897 PrintAndLog("-------------------------------------------------------------");
898 PrintAndLog(" ACL Allocation class (ISO/IEC 15963-1) : 0x%02X (%d)", acl
, acl
);
899 PrintAndLog(" MFC Manufacturer ID (ISO/IEC 7816-6) : 0x%02X (%d) - %s", mfc
, mfc
, getTagInfo(mfc
));
900 PrintAndLog(" CID : 0x%02X (%d) - %s", cid
, cid
, GetModelStrFromCID(cid
));
901 PrintAndLog(" ICR IC Revision : %d",icr
);
902 PrintAndLog(" Manufactured");
903 PrintAndLog(" Year/Quarter : %d/%d",year
, quarter
);
904 PrintAndLog(" Lot ID : %d", lotid
);
905 PrintAndLog(" Wafer number : %d", wafer
);
906 PrintAndLog(" Die Number : %d", dw
);
907 PrintAndLog("-------------------------------------------------------------");
908 PrintAndLog(" Raw Data - Page 1");
909 PrintAndLog(" Block 1 : 0x%08X %s", bl1
, sprint_bin(DemodBuffer
+config
.offset
+repeat
,32) );
910 PrintAndLog(" Block 2 : 0x%08X %s", bl2
, sprint_bin(DemodBuffer
+config
.offset
+repeat
+32,32) );
911 PrintAndLog("-------------------------------------------------------------");
916 1-8 ACL Allocation class (ISO/IEC 15963-1) 0xE0
917 9-16 MFC Manufacturer ID (ISO/IEC 7816-6) 0x15 Atmel Corporation
918 17-21 CID 0x1 = Atmel ATA5577M1 0x2 = Atmel ATA5577M2
919 22-24 ICR IC revision
920 25-28 YEAR (BCD encoded) 9 (= 2009)
921 29-30 QUARTER 1,2,3,4
927 18-32 DW, die number sequential
933 int CmdT55xxInfo(const char *Cmd
){
935 Page 0 Block 0 Configuration data.
939 bool pwdmode
= false;
940 uint32_t password
= 0;
941 char cmdp
= param_getchar(Cmd
, 0);
943 if (strlen(Cmd
) > 1 || cmdp
== 'h' || cmdp
== 'H')
944 return usage_t55xx_info();
947 if ( !AquireData( 0, CONFIGURATION_BLOCK
, pwdmode
, password
) )
950 if (!DecodeT55xxBlock()) return 1;
952 if ( DemodBufferLen
< 32) return 1;
954 uint8_t si
= config
.offset
;
955 uint32_t bl0
= PackBits(si
, 32, DemodBuffer
);
957 uint32_t safer
= PackBits(si
, 4, DemodBuffer
); si
+= 4;
958 uint32_t resv
= PackBits(si
, 7, DemodBuffer
); si
+= 7;
959 uint32_t dbr
= PackBits(si
, 3, DemodBuffer
); si
+= 3;
960 uint32_t extend
= PackBits(si
, 1, DemodBuffer
); si
+= 1;
961 uint32_t datamod
= PackBits(si
, 5, DemodBuffer
); si
+= 5;
962 uint32_t pskcf
= PackBits(si
, 2, DemodBuffer
); si
+= 2;
963 uint32_t aor
= PackBits(si
, 1, DemodBuffer
); si
+= 1;
964 uint32_t otp
= PackBits(si
, 1, DemodBuffer
); si
+= 1;
965 uint32_t maxblk
= PackBits(si
, 3, DemodBuffer
); si
+= 3;
966 uint32_t pwd
= PackBits(si
, 1, DemodBuffer
); si
+= 1;
967 uint32_t sst
= PackBits(si
, 1, DemodBuffer
); si
+= 1;
968 uint32_t fw
= PackBits(si
, 1, DemodBuffer
); si
+= 1;
969 uint32_t inv
= PackBits(si
, 1, DemodBuffer
); si
+= 1;
970 uint32_t por
= PackBits(si
, 1, DemodBuffer
); si
+= 1;
971 if (config
.Q5
) PrintAndLog("*** Warning *** Info read off a Q5 will not work as expected");
973 PrintAndLog("-- T55xx Configuration & Tag Information --------------------");
974 PrintAndLog("-------------------------------------------------------------");
975 PrintAndLog(" Safer key : %s", GetSaferStr(safer
));
976 PrintAndLog(" reserved : %d", resv
);
977 PrintAndLog(" Data bit rate : %s", GetBitRateStr(dbr
));
978 PrintAndLog(" eXtended mode : %s", (extend
) ? "Yes - Warning":"No");
979 PrintAndLog(" Modulation : %s", GetModulationStr(datamod
));
980 PrintAndLog(" PSK clock frequency : %d", pskcf
);
981 PrintAndLog(" AOR - Answer on Request : %s", (aor
) ? "Yes":"No");
982 PrintAndLog(" OTP - One Time Pad : %s", (otp
) ? "Yes - Warning":"No" );
983 PrintAndLog(" Max block : %d", maxblk
);
984 PrintAndLog(" Password mode : %s", (pwd
) ? "Yes":"No");
985 PrintAndLog(" Sequence Start Terminator : %s", (sst
) ? "Yes":"No");
986 PrintAndLog(" Fast Write : %s", (fw
) ? "Yes":"No");
987 PrintAndLog(" Inverse data : %s", (inv
) ? "Yes":"No");
988 PrintAndLog(" POR-Delay : %s", (por
) ? "Yes":"No");
989 PrintAndLog("-------------------------------------------------------------");
990 PrintAndLog(" Raw Data - Page 0");
991 PrintAndLog(" Block 0 : 0x%08X %s", bl0
, sprint_bin(DemodBuffer
+config
.offset
,32) );
992 PrintAndLog("-------------------------------------------------------------");
997 int CmdT55xxDump(const char *Cmd
){
999 uint32_t password
= 0;
1000 char cmdp
= param_getchar(Cmd
, 0);
1001 bool override
= false;
1002 if ( cmdp
== 'h' || cmdp
== 'H') return usage_t55xx_dump();
1004 bool usepwd
= ( strlen(Cmd
) > 0);
1006 password
= param_get32ex(Cmd
, 0, 0, 16);
1007 if (param_getchar(Cmd
, 1) =='o' )
1011 PrintAndLog("Reading Page 0:");
1012 PrintAndLog("blk | hex data | binary");
1013 for ( uint8_t i
= 0; i
<8; ++i
){
1014 T55xxReadBlock(i
, 0, usepwd
, override
, password
);
1015 /*memset(s,0,sizeof(s));
1018 sprintf(s,"b %d p %02x%02x%02x%02x o", i, pwd[0],pwd[1],pwd[2],pwd[3]);
1020 sprintf(s,"b %d p %02x%02x%02x%02x", i, pwd[0],pwd[1],pwd[2],pwd[3]);
1023 sprintf(s,"b %d", i);
1025 CmdT55xxReadBlock(s);*/
1027 PrintAndLog("Reading Page 1:");
1028 PrintAndLog("blk | hex data | binary");
1029 for ( uint8_t i
= 0; i
<4; i
++){
1030 T55xxReadBlock(i
, 1, usepwd
, override
, password
);
1035 int AquireData( uint8_t page
, uint8_t block
, bool pwdmode
, uint32_t password
){
1037 uint8_t arg0
= (page
<<1) | pwdmode
;
1038 UsbCommand c
= {CMD_T55XX_READ_BLOCK
, {arg0
, block
, password
}};
1040 clearCommandBuffer();
1042 if ( !WaitForResponseTimeout(CMD_ACK
,NULL
,2500) ) {
1043 PrintAndLog("command execution time out");
1048 GetFromBigBuf(got
,sizeof(got
),0);
1049 WaitForResponse(CMD_ACK
,NULL
);
1050 setGraphBuf(got
, sizeof(got
));
1054 char * GetBitRateStr(uint32_t id
){
1055 static char buf
[25];
1060 snprintf(retStr
,sizeof(buf
),"%d - RF/8",id
);
1063 snprintf(retStr
,sizeof(buf
),"%d - RF/16",id
);
1066 snprintf(retStr
,sizeof(buf
),"%d - RF/32",id
);
1069 snprintf(retStr
,sizeof(buf
),"%d - RF/40",id
);
1072 snprintf(retStr
,sizeof(buf
),"%d - RF/50",id
);
1075 snprintf(retStr
,sizeof(buf
),"%d - RF/64",id
);
1078 snprintf(retStr
,sizeof(buf
),"%d - RF/100",id
);
1081 snprintf(retStr
,sizeof(buf
),"%d - RF/128",id
);
1084 snprintf(retStr
,sizeof(buf
),"%d - (Unknown)",id
);
1091 char * GetSaferStr(uint32_t id
){
1092 static char buf
[40];
1095 snprintf(retStr
,sizeof(buf
),"%d",id
);
1097 snprintf(retStr
,sizeof(buf
),"%d - passwd",id
);
1100 snprintf(retStr
,sizeof(buf
),"%d - testmode",id
);
1106 char * GetModulationStr( uint32_t id
){
1107 static char buf
[60];
1112 snprintf(retStr
,sizeof(buf
),"%d - DIRECT (ASK/NRZ)",id
);
1115 snprintf(retStr
,sizeof(buf
),"%d - PSK 1 phase change when input changes",id
);
1118 snprintf(retStr
,sizeof(buf
),"%d - PSK 2 phase change on bitclk if input high",id
);
1121 snprintf(retStr
,sizeof(buf
),"%d - PSK 3 phase change on rising edge of input",id
);
1124 snprintf(retStr
,sizeof(buf
),"%d - FSK 1 RF/8 RF/5",id
);
1127 snprintf(retStr
,sizeof(buf
),"%d - FSK 2 RF/8 RF/10",id
);
1130 snprintf(retStr
,sizeof(buf
),"%d - FSK 1a RF/5 RF/8",id
);
1133 snprintf(retStr
,sizeof(buf
),"%d - FSK 2a RF/10 RF/8",id
);
1136 snprintf(retStr
,sizeof(buf
),"%d - Manchester",id
);
1139 snprintf(retStr
,sizeof(buf
),"%d - Biphase",id
);
1142 snprintf(retStr
,sizeof(buf
),"%d - Biphase a - AKA Conditional Dephase Encoding(CDP)",id
);
1145 snprintf(retStr
,sizeof(buf
),"%d - Reserved",id
);
1148 snprintf(retStr
,sizeof(buf
),"0x%02X (Unknown)",id
);
1154 char * GetModelStrFromCID(uint32_t cid
){
1156 static char buf
[10];
1159 if (cid
== 1) snprintf(retStr
, sizeof(buf
),"ATA5577M1");
1160 if (cid
== 2) snprintf(retStr
, sizeof(buf
),"ATA5577M2");
1164 char * GetSelectedModulationStr( uint8_t id
){
1166 static char buf
[20];
1171 snprintf(retStr
,sizeof(buf
),"FSK");
1174 snprintf(retStr
,sizeof(buf
),"FSK1");
1177 snprintf(retStr
,sizeof(buf
),"FSK1a");
1180 snprintf(retStr
,sizeof(buf
),"FSK2");
1183 snprintf(retStr
,sizeof(buf
),"FSK2a");
1186 snprintf(retStr
,sizeof(buf
),"ASK");
1189 snprintf(retStr
,sizeof(buf
),"DIRECT/NRZ");
1192 snprintf(retStr
,sizeof(buf
),"PSK1");
1195 snprintf(retStr
,sizeof(buf
),"PSK2");
1198 snprintf(retStr
,sizeof(buf
),"PSK3");
1201 snprintf(retStr
,sizeof(buf
),"BIPHASE");
1204 snprintf(retStr
,sizeof(buf
),"BIPHASEa - (CDP)");
1207 snprintf(retStr
,sizeof(buf
),"(Unknown)");
1213 uint32_t PackBits(uint8_t start
, uint8_t len
, uint8_t* bits
){
1218 if (len
> 32) return 0;
1221 for (; j
>= 0; --j
, ++i
)
1222 tmp
|= bits
[i
] << j
;
1227 int CmdResetRead(const char *Cmd
) {
1228 UsbCommand c
= {CMD_T55XX_RESET_READ
, {0,0,0}};
1230 clearCommandBuffer();
1232 if ( !WaitForResponseTimeout(CMD_ACK
,NULL
,2500) ) {
1233 PrintAndLog("command execution time out");
1237 uint8_t got
[BIGBUF_SIZE
-1];
1238 GetFromBigBuf(got
,sizeof(got
),0);
1239 WaitForResponse(CMD_ACK
,NULL
);
1240 setGraphBuf(got
, sizeof(got
));
1244 int CmdT55xxWipe(const char *Cmd
) {
1245 char writeData
[20] = {0};
1246 char *ptrData
= writeData
;
1248 PrintAndLog("\nBeginning Wipe of a T55xx tag (assuming the tag is not password protected)\n");
1249 //try with the default password to reset block 0 (with a pwd should work even if pwd bit not set)
1250 snprintf(ptrData
,sizeof(writeData
),"b %d d 00088040 p 0", blk
);
1251 if (!CmdT55xxWriteBlock(ptrData
)){
1252 PrintAndLog("Error writing blk %d", blk
);
1255 for (; blk
<8; blk
++) {
1256 snprintf(ptrData
,sizeof(writeData
),"b %d d 0", blk
);
1257 if (!CmdT55xxWriteBlock(ptrData
)){
1258 PrintAndLog("Error writing blk %d", blk
);
1264 static command_t CommandTable
[] =
1266 {"help", CmdHelp
, 1, "This help"},
1267 {"config", CmdT55xxSetConfig
, 1, "Set/Get T55XX configuration (modulation, inverted, offset, rate)"},
1268 {"detect", CmdT55xxDetect
, 0, "[1] Try detecting the tag modulation from reading the configuration block."},
1269 {"read", CmdT55xxReadBlock
, 0, "b <block> p [password] [o] [1] -- Read T55xx block data. Optional [p password], [override], [page1]"},
1270 {"resetread",CmdResetRead
, 0, "Send Reset Cmd then lf read the stream to attempt to identify the start of it (needs a demod and/or plot after)"},
1271 {"write", CmdT55xxWriteBlock
,0, "b <block> d <data> p [password] [1] -- Write T55xx block data. Optional [p password], [page1]"},
1272 {"trace", CmdT55xxReadTrace
, 0, "[1] Show T55xx traceability data (page 1/ blk 0-1)"},
1273 {"info", CmdT55xxInfo
, 0, "[1] Show T55xx configuration data (page 0/ blk 0)"},
1274 {"dump", CmdT55xxDump
, 0, "[password] [o] Dump T55xx card block 0-7. Optional [password], [override]"},
1275 {"special", special
, 0, "Show block changes with 64 different offsets"},
1276 {"wakeup", CmdT55xxWakeUp
, 0, "Send AOR wakeup command"},
1277 {"wipe", CmdT55xxWipe
, 0, "Wipe a T55xx tag and set defaults (will destroy any data on tag)"},
1278 {NULL
, NULL
, 0, NULL
}
1281 int CmdLFT55XX(const char *Cmd
)
1283 CmdsParse(CommandTable
, Cmd
);
1287 int CmdHelp(const char *Cmd
)
1289 CmdsHelp(CommandTable
);