]>
cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfem4x.c
67013b2e813a483a1fc70853f752f51c1d4910f3
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // Low frequency EM4x commands
9 //-----------------------------------------------------------------------------
14 #include "proxmark3.h"
18 #include "cmdparser.h"
21 #include "cmdlfem4x.h"
24 #define LF_TRACE_BUFF_SIZE 12000
25 #define LF_BITSSTREAM_LEN 1000
27 char *global_em410xId
;
29 static int CmdHelp(const char *Cmd
);
31 /* Read the ID of an EM410x tag.
33 * 1111 1111 1 <-- standard non-repeatable header
34 * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
36 * CCCC <-- each bit here is parity for the 10 bits above in corresponding column
37 * 0 <-- stop bit, end of tag
39 int CmdEM410xRead(const char *Cmd
)
41 int i
, j
, clock
, header
, rows
, bit
, hithigh
, hitlow
, first
, bit2idx
, high
, low
;
46 uint8_t BitStream
[MAX_GRAPH_TRACE_LEN
];
49 /* Detect high and lows and clock */
50 for (i
= 0; i
< GraphTraceLen
; i
++)
52 if (GraphBuffer
[i
] > high
)
53 high
= GraphBuffer
[i
];
54 else if (GraphBuffer
[i
] < low
)
59 clock
= GetClock(Cmd
, high
, 0);
61 /* parity for our 4 columns */
62 parity
[0] = parity
[1] = parity
[2] = parity
[3] = 0;
65 /* manchester demodulate */
67 for (i
= 0; i
< (int)(GraphTraceLen
/ clock
); i
++)
73 /* Find out if we hit both high and low peaks */
74 for (j
= 0; j
< clock
; j
++)
76 if (GraphBuffer
[(i
* clock
) + j
] == high
)
78 else if (GraphBuffer
[(i
* clock
) + j
] == low
)
81 /* it doesn't count if it's the first part of our read
82 because it's really just trailing from the last sequence */
83 if (first
&& (hithigh
|| hitlow
))
88 if (hithigh
&& hitlow
)
92 /* If we didn't hit both high and low peaks, we had a bit transition */
93 if (!hithigh
|| !hitlow
)
96 BitStream
[bit2idx
++] = bit
;
100 /* We go till 5 before the graph ends because we'll get that far below */
101 for (i
= 0; i
< bit2idx
- 5; i
++)
103 /* Step 2: We have our header but need our tag ID */
104 if (header
== 9 && rows
< 10)
106 /* Confirm parity is correct */
107 if ((BitStream
[i
] ^ BitStream
[i
+1] ^ BitStream
[i
+2] ^ BitStream
[i
+3]) == BitStream
[i
+4])
109 /* Read another byte! */
110 sprintf(id
+rows
, "%x", (8 * BitStream
[i
]) + (4 * BitStream
[i
+1]) + (2 * BitStream
[i
+2]) + (1 * BitStream
[i
+3]));
111 sprintf(id2
+rows
, "%x", (8 * BitStream
[i
+3]) + (4 * BitStream
[i
+2]) + (2 * BitStream
[i
+1]) + (1 * BitStream
[i
]));
114 /* Keep parity info */
115 parity
[0] ^= BitStream
[i
];
116 parity
[1] ^= BitStream
[i
+1];
117 parity
[2] ^= BitStream
[i
+2];
118 parity
[3] ^= BitStream
[i
+3];
120 /* Move 4 bits ahead */
124 /* Damn, something wrong! reset */
127 PrintAndLog("Thought we had a valid tag but failed at word %d (i=%d)", rows
+ 1, i
);
129 /* Start back rows * 5 + 9 header bits, -1 to not start at same place */
130 i
-= 9 + (5 * rows
) -2;
136 /* Step 3: Got our 40 bits! confirm column parity */
139 /* We need to make sure our 4 bits of parity are correct and we have a stop bit */
140 if (BitStream
[i
] == parity
[0] && BitStream
[i
+1] == parity
[1] &&
141 BitStream
[i
+2] == parity
[2] && BitStream
[i
+3] == parity
[3] &&
145 PrintAndLog("EM410x Tag ID: %s", id
);
146 PrintAndLog("Unique Tag ID: %s", id2
);
148 global_em410xId
= id
;
154 /* Crap! Incorrect parity or no stop bit, start all over */
159 /* Go back 59 bits (9 header bits + 10 rows at 4+1 parity) */
164 /* Step 1: get our header */
167 /* Need 9 consecutive 1's */
168 if (BitStream
[i
] == 1)
171 /* We don't have a header, not enough consecutive 1 bits */
177 /* if we've already retested after flipping bits, return */
182 /* if this didn't work, try flipping bits */
183 for (i
= 0; i
< bit2idx
; i
++)
189 /* emulate an EM410X tag
191 * 1111 1111 1 <-- standard non-repeatable header
192 * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
194 * CCCC <-- each bit here is parity for the 10 bits above in corresponding column
195 * 0 <-- stop bit, end of tag
197 int CmdEM410xSim(const char *Cmd
)
199 int i
, n
, j
, h
, binary
[4], parity
[4];
201 char cmdp
= param_getchar(Cmd
, 0);
202 uint8_t uid
[5] = {0x00};
204 if (cmdp
== 'h' || cmdp
== 'H') {
205 PrintAndLog("Usage: lf em4x sim <UID>");
207 PrintAndLog(" sample: lf em4x sim 0F0368568B");
211 if (param_gethex(Cmd
, 0, uid
, 10)) {
212 PrintAndLog("UID must include 10 HEX symbols");
216 PrintAndLog("Starting simulating UID %02X%02X%02X%02X%02X", uid
[0],uid
[1],uid
[2],uid
[3],uid
[4]);
217 PrintAndLog("Press pm3-button to about simulation");
219 /* clock is 64 in EM410x tags */
222 /* clear our graph */
225 /* write it out a few times */
226 for (h
= 0; h
< 4; h
++)
228 /* write 9 start bits */
229 for (i
= 0; i
< 9; i
++)
230 AppendGraph(0, clock
, 1);
232 /* for each hex char */
233 parity
[0] = parity
[1] = parity
[2] = parity
[3] = 0;
234 for (i
= 0; i
< 10; i
++)
236 /* read each hex char */
237 sscanf(&Cmd
[i
], "%1x", &n
);
238 for (j
= 3; j
>= 0; j
--, n
/= 2)
241 /* append each bit */
242 AppendGraph(0, clock
, binary
[0]);
243 AppendGraph(0, clock
, binary
[1]);
244 AppendGraph(0, clock
, binary
[2]);
245 AppendGraph(0, clock
, binary
[3]);
247 /* append parity bit */
248 AppendGraph(0, clock
, binary
[0] ^ binary
[1] ^ binary
[2] ^ binary
[3]);
250 /* keep track of column parity */
251 parity
[0] ^= binary
[0];
252 parity
[1] ^= binary
[1];
253 parity
[2] ^= binary
[2];
254 parity
[3] ^= binary
[3];
258 AppendGraph(0, clock
, parity
[0]);
259 AppendGraph(0, clock
, parity
[1]);
260 AppendGraph(0, clock
, parity
[2]);
261 AppendGraph(0, clock
, parity
[3]);
264 AppendGraph(0, clock
, 0);
267 /* modulate that biatch */
268 CmdManchesterMod("64");
271 RepaintGraphWindow();
277 /* Function is equivalent of lf read + data samples + em410xread
278 * looped until an EM410x tag is detected
280 * Why is CmdSamples("16000")?
281 * TBD: Auto-grow sample size based on detected sample rate. IE: If the
282 * rate gets lower, then grow the number of samples
283 * Changed by martin, 4000 x 4 = 16000,
284 * see http://www.proxmark.org/forum/viewtopic.php?pid=7235#p7235
287 int CmdEM410xWatch(const char *Cmd
)
289 int read_h
= (*Cmd
== 'h');
293 printf("\naborted via keyboard!\n");
297 CmdLFRead(read_h
? "h" : "");
306 int CmdEM410xWatchnSpoof(const char *Cmd
)
309 PrintAndLog("# Replaying : %s",global_em410xId
);
310 CmdEM410xSim(global_em410xId
);
314 /* Read the transmitted data of an EM4x50 tag
317 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
318 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
319 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
320 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
321 * CCCCCCCC <- column parity bits
323 * LW <- Listen Window
325 * This pattern repeats for every block of data being transmitted.
326 * Transmission starts with two Listen Windows (LW - a modulated
327 * pattern of 320 cycles each (32/32/128/64/64)).
329 * Note that this data may or may not be the UID. It is whatever data
330 * is stored in the blocks defined in the control word First and Last
331 * Word Read values. UID is stored in block 32.
333 int CmdEM4x50Read(const char *Cmd
)
335 int i
, j
, startblock
, skip
, block
, start
, end
, low
, high
;
336 bool complete
= false;
337 int tmpbuff
[MAX_GRAPH_TRACE_LEN
/ 64];
341 memset(tmpbuff
, 0, MAX_GRAPH_TRACE_LEN
/ 64);
343 /* first get high and low values */
344 for (i
= 0; i
< GraphTraceLen
; i
++)
346 if (GraphBuffer
[i
] > high
)
347 high
= GraphBuffer
[i
];
348 else if (GraphBuffer
[i
] < low
)
349 low
= GraphBuffer
[i
];
352 /* populate a buffer with pulse lengths */
355 while (i
< GraphTraceLen
)
357 // measure from low to low
358 while ((GraphBuffer
[i
] > low
) && (i
<GraphTraceLen
))
361 while ((GraphBuffer
[i
] < high
) && (i
<GraphTraceLen
))
363 while ((GraphBuffer
[i
] > low
) && (i
<GraphTraceLen
))
365 if (j
>=(MAX_GRAPH_TRACE_LEN
/64)) {
368 tmpbuff
[j
++]= i
- start
;
371 /* look for data start - should be 2 pairs of LW (pulses of 192,128) */
374 for (i
= 0; i
< j
- 4 ; ++i
)
377 if (tmpbuff
[i
] >= 190 && tmpbuff
[i
] <= 194)
378 if (tmpbuff
[i
+1] >= 126 && tmpbuff
[i
+1] <= 130)
379 if (tmpbuff
[i
+2] >= 190 && tmpbuff
[i
+2] <= 194)
380 if (tmpbuff
[i
+3] >= 126 && tmpbuff
[i
+3] <= 130)
388 /* skip over the remainder of the LW */
389 skip
+= tmpbuff
[i
+1]+tmpbuff
[i
+2];
390 while (skip
< MAX_GRAPH_TRACE_LEN
&& GraphBuffer
[skip
] > low
)
394 /* now do it again to find the end */
396 for (i
+= 3; i
< j
- 4 ; ++i
)
399 if (tmpbuff
[i
] >= 190 && tmpbuff
[i
] <= 194)
400 if (tmpbuff
[i
+1] >= 126 && tmpbuff
[i
+1] <= 130)
401 if (tmpbuff
[i
+2] >= 190 && tmpbuff
[i
+2] <= 194)
402 if (tmpbuff
[i
+3] >= 126 && tmpbuff
[i
+3] <= 130)
410 PrintAndLog("Found data at sample: %i",skip
);
413 PrintAndLog("No data found!");
414 PrintAndLog("Try again with more samples.");
420 PrintAndLog("*** Warning!");
421 PrintAndLog("Partial data - no end found!");
422 PrintAndLog("Try again with more samples.");
425 /* get rid of leading crap */
426 sprintf(tmp
,"%i",skip
);
429 /* now work through remaining buffer printing out data blocks */
434 PrintAndLog("Block %i:", block
);
435 // mandemod routine needs to be split so we can call it for data
436 // just print for now for debugging
437 CmdManchesterDemod("i 64");
439 /* look for LW before start of next block */
440 for ( ; i
< j
- 4 ; ++i
)
443 if (tmpbuff
[i
] >= 190 && tmpbuff
[i
] <= 194)
444 if (tmpbuff
[i
+1] >= 126 && tmpbuff
[i
+1] <= 130)
447 while (GraphBuffer
[skip
] > low
)
450 sprintf(tmp
,"%i",skip
);
458 int CmdEM410xWrite(const char *Cmd
)
460 uint64_t id
= 0xFFFFFFFFFFFFFFFF; // invalid id value
461 int card
= 0xFF; // invalid card value
462 unsigned int clock
= 0; // invalid clock value
464 sscanf(Cmd
, "%" PRIx64
" %d %d", &id
, &card
, &clock
);
467 if (id
== 0xFFFFFFFFFFFFFFFF) {
468 PrintAndLog("Error! ID is required.\n");
471 if (id
>= 0x10000000000) {
472 PrintAndLog("Error! Given EM410x ID is longer than 40 bits.\n");
478 PrintAndLog("Error! Card type required.\n");
482 PrintAndLog("Error! Bad card type selected.\n");
493 // Allowed clock rates: 16, 32 and 64
494 if ((clock
!= 16) && (clock
!= 32) && (clock
!= 64)) {
495 PrintAndLog("Error! Clock rate %d not valid. Supported clock rates are 16, 32 and 64.\n", clock
);
501 PrintAndLog("Error! Clock rate is only supported on T55x7 tags.\n");
506 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64
" (clock rate: %d)", "T55x7", id
, clock
);
507 // NOTE: We really should pass the clock in as a separate argument, but to
508 // provide for backwards-compatibility for older firmware, and to avoid
509 // having to add another argument to CMD_EM410X_WRITE_TAG, we just store
510 // the clock rate in bits 8-15 of the card value
511 card
= (card
& 0xFF) | (((uint64_t)clock
<< 8) & 0xFF00);
514 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64
, "T5555", id
, clock
);
516 PrintAndLog("Error! Bad card type selected.\n");
520 UsbCommand c
= {CMD_EM410X_WRITE_TAG
, {card
, (uint32_t)(id
>> 32), (uint32_t)id
}};
526 int CmdReadWord(const char *Cmd
)
528 int Word
= -1; //default to invalid word
531 sscanf(Cmd
, "%d", &Word
);
533 if ( (Word
> 15) | (Word
< 0) ) {
534 PrintAndLog("Word must be between 0 and 15");
538 PrintAndLog("Reading word %d", Word
);
540 c
.cmd
= CMD_EM4X_READ_WORD
;
541 c
.d
.asBytes
[0] = 0x0; //Normal mode
546 WaitForResponse(CMD_ACK
, NULL
);
548 uint8_t data
[LF_TRACE_BUFF_SIZE
] = {0x00};
550 GetFromBigBuf(data
,LF_TRACE_BUFF_SIZE
,3560); //3560 -- should be offset..
551 WaitForResponseTimeout(CMD_ACK
,NULL
, 1500);
553 for (int j
= 0; j
< LF_TRACE_BUFF_SIZE
; j
++) {
554 GraphBuffer
[j
] = ((int)data
[j
]);
556 GraphTraceLen
= LF_TRACE_BUFF_SIZE
;
558 uint8_t bits
[LF_BITSSTREAM_LEN
] = {0x00};
559 uint8_t * bitstream
= bits
;
560 manchester_decode(GraphBuffer
, LF_TRACE_BUFF_SIZE
, bitstream
,LF_BITSSTREAM_LEN
);
561 RepaintGraphWindow();
565 int CmdReadWordPWD(const char *Cmd
)
567 int Word
= -1; //default to invalid word
568 int Password
= 0xFFFFFFFF; //default to blank password
571 sscanf(Cmd
, "%d %x", &Word
, &Password
);
573 if ( (Word
> 15) | (Word
< 0) ) {
574 PrintAndLog("Word must be between 0 and 15");
578 PrintAndLog("Reading word %d with password %08X", Word
, Password
);
580 c
.cmd
= CMD_EM4X_READ_WORD
;
581 c
.d
.asBytes
[0] = 0x1; //Password mode
586 WaitForResponse(CMD_ACK
, NULL
);
588 uint8_t data
[LF_TRACE_BUFF_SIZE
] = {0x00};
590 GetFromBigBuf(data
,LF_TRACE_BUFF_SIZE
,3560); //3560 -- should be offset..
591 WaitForResponseTimeout(CMD_ACK
,NULL
, 1500);
593 for (int j
= 0; j
< LF_TRACE_BUFF_SIZE
; j
++) {
594 GraphBuffer
[j
] = ((int)data
[j
]);
596 GraphTraceLen
= LF_TRACE_BUFF_SIZE
;
598 uint8_t bits
[LF_BITSSTREAM_LEN
] = {0x00};
599 uint8_t * bitstream
= bits
;
600 manchester_decode(GraphBuffer
, LF_TRACE_BUFF_SIZE
, bitstream
, LF_BITSSTREAM_LEN
);
601 RepaintGraphWindow();
605 int CmdWriteWord(const char *Cmd
)
607 int Word
= 16; //default to invalid block
608 int Data
= 0xFFFFFFFF; //default to blank data
611 sscanf(Cmd
, "%x %d", &Data
, &Word
);
614 PrintAndLog("Word must be between 0 and 15");
618 PrintAndLog("Writing word %d with data %08X", Word
, Data
);
620 c
.cmd
= CMD_EM4X_WRITE_WORD
;
621 c
.d
.asBytes
[0] = 0x0; //Normal mode
629 int CmdWriteWordPWD(const char *Cmd
)
631 int Word
= 16; //default to invalid word
632 int Data
= 0xFFFFFFFF; //default to blank data
633 int Password
= 0xFFFFFFFF; //default to blank password
636 sscanf(Cmd
, "%x %d %x", &Data
, &Word
, &Password
);
639 PrintAndLog("Word must be between 0 and 15");
643 PrintAndLog("Writing word %d with data %08X and password %08X", Word
, Data
, Password
);
645 c
.cmd
= CMD_EM4X_WRITE_WORD
;
646 c
.d
.asBytes
[0] = 0x1; //Password mode
654 static command_t CommandTable
[] =
656 {"help", CmdHelp
, 1, "This help"},
657 {"410xread", CmdEM410xRead
, 1, "[clock rate] -- Extract ID from EM410x tag"},
658 {"410xsim", CmdEM410xSim
, 0, "<UID> -- Simulate EM410x tag"},
659 {"410xwatch", CmdEM410xWatch
, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"},
660 {"410xspoof", CmdEM410xWatchnSpoof
, 0, "['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)" },
661 {"410xwrite", CmdEM410xWrite
, 1, "<UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"},
662 {"4x50read", CmdEM4x50Read
, 1, "Extract data from EM4x50 tag"},
663 {"rd", CmdReadWord
, 1, "<Word 1-15> -- Read EM4xxx word data"},
664 {"rdpwd", CmdReadWordPWD
, 1, "<Word 1-15> <Password> -- Read EM4xxx word data in password mode "},
665 {"wr", CmdWriteWord
, 1, "<Data> <Word 1-15> -- Write EM4xxx word data"},
666 {"wrpwd", CmdWriteWordPWD
, 1, "<Data> <Word 1-15> <Password> -- Write EM4xxx word data in password mode"},
667 {NULL
, NULL
, 0, NULL
}
670 int CmdLFEM4X(const char *Cmd
)
672 CmdsParse(CommandTable
, Cmd
);
676 int CmdHelp(const char *Cmd
)
678 CmdsHelp(CommandTable
);