]> cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfem4x.c
minor fixes
[proxmark3-svn] / client / cmdlfem4x.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // Low frequency EM4x commands
9 //-----------------------------------------------------------------------------
10
11 #include <stdio.h>
12 #include <string.h>
13 #include <inttypes.h>
14 #include "proxmark3.h"
15 #include "ui.h"
16 #include "util.h"
17 #include "graph.h"
18 #include "cmdparser.h"
19 #include "cmddata.h"
20 #include "cmdlf.h"
21 #include "cmdlfem4x.h"
22 #include "lfdemod.h"
23
24 #define llx PRIx64
25
26 char *global_em410xId;
27
28 static int CmdHelp(const char *Cmd);
29
30 int CmdEMdemodASK(const char *Cmd)
31 {
32 char cmdp = param_getchar(Cmd, 0);
33 int findone = (cmdp == '1') ? 1 : 0;
34 UsbCommand c={CMD_EM410X_DEMOD};
35 c.arg[0]=findone;
36 SendCommand(&c);
37 return 0;
38 }
39
40 /* Read the ID of an EM410x tag.
41 * Format:
42 * 1111 1111 1 <-- standard non-repeatable header
43 * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
44 * ....
45 * CCCC <-- each bit here is parity for the 10 bits above in corresponding column
46 * 0 <-- stop bit, end of tag
47 */
48 int CmdEM410xRead(const char *Cmd)
49 {
50 uint32_t hi=0;
51 uint64_t lo=0;
52
53 if(!AskEm410xDemod("", &hi, &lo, false)) return 0;
54 PrintAndLog("EM410x pattern found: ");
55 printEM410x(hi, lo);
56 if (hi){
57 PrintAndLog ("EM410x XL pattern found");
58 return 0;
59 }
60 char id[12] = {0x00};
61 sprintf(id, "%010llx",lo);
62
63 global_em410xId = id;
64 return 1;
65 }
66
67 // emulate an EM410X tag
68 int CmdEM410xSim(const char *Cmd)
69 {
70 int i, n, j, binary[4], parity[4];
71
72 char cmdp = param_getchar(Cmd, 0);
73 uint8_t uid[5] = {0x00};
74
75 if (cmdp == 'h' || cmdp == 'H') {
76 PrintAndLog("Usage: lf em4x 410xsim <UID>");
77 PrintAndLog("");
78 PrintAndLog(" sample: lf em4x 410xsim 0F0368568B");
79 return 0;
80 }
81
82 if (param_gethex(Cmd, 0, uid, 10)) {
83 PrintAndLog("UID must include 10 HEX symbols");
84 return 0;
85 }
86
87 PrintAndLog("Starting simulating UID %02X%02X%02X%02X%02X", uid[0],uid[1],uid[2],uid[3],uid[4]);
88 PrintAndLog("Press pm3-button to about simulation");
89
90 /* clock is 64 in EM410x tags */
91 int clock = 64;
92
93 /* clear our graph */
94 ClearGraph(0);
95
96 /* write 9 start bits */
97 for (i = 0; i < 9; i++)
98 AppendGraph(0, clock, 1);
99
100 /* for each hex char */
101 parity[0] = parity[1] = parity[2] = parity[3] = 0;
102 for (i = 0; i < 10; i++)
103 {
104 /* read each hex char */
105 sscanf(&Cmd[i], "%1x", &n);
106 for (j = 3; j >= 0; j--, n/= 2)
107 binary[j] = n % 2;
108
109 /* append each bit */
110 AppendGraph(0, clock, binary[0]);
111 AppendGraph(0, clock, binary[1]);
112 AppendGraph(0, clock, binary[2]);
113 AppendGraph(0, clock, binary[3]);
114
115 /* append parity bit */
116 AppendGraph(0, clock, binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
117
118 /* keep track of column parity */
119 parity[0] ^= binary[0];
120 parity[1] ^= binary[1];
121 parity[2] ^= binary[2];
122 parity[3] ^= binary[3];
123 }
124
125 /* parity columns */
126 AppendGraph(0, clock, parity[0]);
127 AppendGraph(0, clock, parity[1]);
128 AppendGraph(0, clock, parity[2]);
129 AppendGraph(0, clock, parity[3]);
130
131 /* stop bit */
132 AppendGraph(1, clock, 0);
133
134 CmdLFSim("0"); //240 start_gap.
135 return 0;
136 }
137
138 /* Function is equivalent of lf read + data samples + em410xread
139 * looped until an EM410x tag is detected
140 *
141 * Why is CmdSamples("16000")?
142 * TBD: Auto-grow sample size based on detected sample rate. IE: If the
143 * rate gets lower, then grow the number of samples
144 * Changed by martin, 4000 x 4 = 16000,
145 * see http://www.proxmark.org/forum/viewtopic.php?pid=7235#p7235
146 */
147 int CmdEM410xWatch(const char *Cmd)
148 {
149 do {
150 if (ukbhit()) {
151 printf("\naborted via keyboard!\n");
152 break;
153 }
154
155 CmdLFRead("s");
156 getSamples("8201",true); //capture enough to get 2 complete preambles (4096*2+9)
157 } while (!CmdEM410xRead(""));
158
159 return 0;
160 }
161
162 //currently only supports manchester modulations
163 int CmdEM410xWatchnSpoof(const char *Cmd)
164 {
165 CmdEM410xWatch(Cmd);
166 PrintAndLog("# Replaying captured ID: %s",global_em410xId);
167 CmdLFaskSim("");
168 return 0;
169 }
170
171 int CmdEM410xWrite(const char *Cmd)
172 {
173 uint64_t id = 0xFFFFFFFFFFFFFFFF; // invalid id value
174 int card = 0xFF; // invalid card value
175 unsigned int clock = 0; // invalid clock value
176
177 sscanf(Cmd, "%" PRIx64 " %d %d", &id, &card, &clock);
178
179 // Check ID
180 if (id == 0xFFFFFFFFFFFFFFFF) {
181 PrintAndLog("Error! ID is required.\n");
182 return 0;
183 }
184 if (id >= 0x10000000000) {
185 PrintAndLog("Error! Given EM410x ID is longer than 40 bits.\n");
186 return 0;
187 }
188
189 // Check Card
190 if (card == 0xFF) {
191 PrintAndLog("Error! Card type required.\n");
192 return 0;
193 }
194 if (card < 0) {
195 PrintAndLog("Error! Bad card type selected.\n");
196 return 0;
197 }
198
199 // Check Clock
200 if (card == 1)
201 {
202 // Default: 64
203 if (clock == 0)
204 clock = 64;
205
206 // Allowed clock rates: 16, 32 and 64
207 if ((clock != 16) && (clock != 32) && (clock != 64)) {
208 PrintAndLog("Error! Clock rate %d not valid. Supported clock rates are 16, 32 and 64.\n", clock);
209 return 0;
210 }
211 }
212 else if (clock != 0)
213 {
214 PrintAndLog("Error! Clock rate is only supported on T55x7 tags.\n");
215 return 0;
216 }
217
218 if (card == 1) {
219 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64 " (clock rate: %d)", "T55x7", id, clock);
220 // NOTE: We really should pass the clock in as a separate argument, but to
221 // provide for backwards-compatibility for older firmware, and to avoid
222 // having to add another argument to CMD_EM410X_WRITE_TAG, we just store
223 // the clock rate in bits 8-15 of the card value
224 card = (card & 0xFF) | (((uint64_t)clock << 8) & 0xFF00);
225 }
226 else if (card == 0)
227 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64, "T5555", id, clock);
228 else {
229 PrintAndLog("Error! Bad card type selected.\n");
230 return 0;
231 }
232
233 UsbCommand c = {CMD_EM410X_WRITE_TAG, {card, (uint32_t)(id >> 32), (uint32_t)id}};
234 SendCommand(&c);
235
236 return 0;
237 }
238
239 bool EM_EndParityTest(uint8_t *BitStream, size_t size, uint8_t rows, uint8_t cols, uint8_t pType)
240 {
241 if (rows*cols>size) return false;
242 uint8_t colP=0;
243 //assume last col is a parity and do not test
244 for (uint8_t colNum = 0; colNum < cols-1; colNum++) {
245 for (uint8_t rowNum = 0; rowNum < rows; rowNum++) {
246 colP ^= BitStream[(rowNum*cols)+colNum];
247 }
248 if (colP != pType) return false;
249 }
250 return true;
251 }
252
253 bool EM_ByteParityTest(uint8_t *BitStream, size_t size, uint8_t rows, uint8_t cols, uint8_t pType)
254 {
255 if (rows*cols>size) return false;
256 uint8_t rowP=0;
257 //assume last row is a parity row and do not test
258 for (uint8_t rowNum = 0; rowNum < rows-1; rowNum++) {
259 for (uint8_t colNum = 0; colNum < cols; colNum++) {
260 rowP ^= BitStream[(rowNum*cols)+colNum];
261 }
262 if (rowP != pType) return false;
263 }
264 return true;
265 }
266
267 uint32_t OutputEM4x50_Block(uint8_t *BitStream, size_t size, bool verbose, bool pTest)
268 {
269 if (size<45) return 0;
270 uint32_t code = bytebits_to_byte(BitStream,8);
271 code = code<<8 | bytebits_to_byte(BitStream+9,8);
272 code = code<<8 | bytebits_to_byte(BitStream+18,8);
273 code = code<<8 | bytebits_to_byte(BitStream+27,8);
274 if (verbose || g_debugMode){
275 for (uint8_t i = 0; i<5; i++){
276 if (i == 4) PrintAndLog(""); //parity byte spacer
277 PrintAndLog("%d%d%d%d%d%d%d%d %d -> 0x%02x",
278 BitStream[i*9],
279 BitStream[i*9+1],
280 BitStream[i*9+2],
281 BitStream[i*9+3],
282 BitStream[i*9+4],
283 BitStream[i*9+5],
284 BitStream[i*9+6],
285 BitStream[i*9+7],
286 BitStream[i*9+8],
287 bytebits_to_byte(BitStream+i*9,8)
288 );
289 }
290 if (pTest)
291 PrintAndLog("Parity Passed");
292 else
293 PrintAndLog("Parity Failed");
294 }
295 return code;
296 }
297 /* Read the transmitted data of an EM4x50 tag
298 * Format:
299 *
300 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
301 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
302 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
303 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
304 * CCCCCCCC <- column parity bits
305 * 0 <- stop bit
306 * LW <- Listen Window
307 *
308 * This pattern repeats for every block of data being transmitted.
309 * Transmission starts with two Listen Windows (LW - a modulated
310 * pattern of 320 cycles each (32/32/128/64/64)).
311 *
312 * Note that this data may or may not be the UID. It is whatever data
313 * is stored in the blocks defined in the control word First and Last
314 * Word Read values. UID is stored in block 32.
315 */
316 //completed by Marshmellow
317 int EM4x50Read(const char *Cmd, bool verbose)
318 {
319 uint8_t fndClk[] = {8,16,32,40,50,64,128};
320 int clk = 0;
321 int invert = 0;
322 int tol = 0;
323 int i, j, startblock, skip, block, start, end, low, high, minClk;
324 bool complete = false;
325 int tmpbuff[MAX_GRAPH_TRACE_LEN / 64];
326 uint32_t Code[6];
327 char tmp[6];
328 char tmp2[20];
329 int phaseoff;
330 high = low = 0;
331 memset(tmpbuff, 0, MAX_GRAPH_TRACE_LEN / 64);
332
333 // get user entry if any
334 sscanf(Cmd, "%i %i", &clk, &invert);
335
336 // save GraphBuffer - to restore it later
337 save_restoreGB(1);
338
339 // first get high and low values
340 for (i = 0; i < GraphTraceLen; i++) {
341 if (GraphBuffer[i] > high)
342 high = GraphBuffer[i];
343 else if (GraphBuffer[i] < low)
344 low = GraphBuffer[i];
345 }
346
347 i = 0;
348 j = 0;
349 minClk = 255;
350 // get to first full low to prime loop and skip incomplete first pulse
351 while ((GraphBuffer[i] < high) && (i < GraphTraceLen))
352 ++i;
353 while ((GraphBuffer[i] > low) && (i < GraphTraceLen))
354 ++i;
355 skip = i;
356
357 // populate tmpbuff buffer with pulse lengths
358 while (i < GraphTraceLen) {
359 // measure from low to low
360 while ((GraphBuffer[i] > low) && (i < GraphTraceLen))
361 ++i;
362 start= i;
363 while ((GraphBuffer[i] < high) && (i < GraphTraceLen))
364 ++i;
365 while ((GraphBuffer[i] > low) && (i < GraphTraceLen))
366 ++i;
367 if (j>=(MAX_GRAPH_TRACE_LEN/64)) {
368 break;
369 }
370 tmpbuff[j++]= i - start;
371 if (i-start < minClk && i < GraphTraceLen) {
372 minClk = i - start;
373 }
374 }
375 // set clock
376 if (!clk) {
377 for (uint8_t clkCnt = 0; clkCnt<7; clkCnt++) {
378 tol = fndClk[clkCnt]/8;
379 if (minClk >= fndClk[clkCnt]-tol && minClk <= fndClk[clkCnt]+1) {
380 clk=fndClk[clkCnt];
381 break;
382 }
383 }
384 if (!clk) return 0;
385 } else tol = clk/8;
386
387 // look for data start - should be 2 pairs of LW (pulses of clk*3,clk*2)
388 start = -1;
389 for (i= 0; i < j - 4 ; ++i) {
390 skip += tmpbuff[i];
391 if (tmpbuff[i] >= clk*3-tol && tmpbuff[i] <= clk*3+tol) //3 clocks
392 if (tmpbuff[i+1] >= clk*2-tol && tmpbuff[i+1] <= clk*2+tol) //2 clocks
393 if (tmpbuff[i+2] >= clk*3-tol && tmpbuff[i+2] <= clk*3+tol) //3 clocks
394 if (tmpbuff[i+3] >= clk-tol) //1.5 to 2 clocks - depends on bit following
395 {
396 start= i + 4;
397 break;
398 }
399 }
400 startblock = i + 4;
401
402 // skip over the remainder of LW
403 skip += tmpbuff[i+1] + tmpbuff[i+2] + clk;
404 if (tmpbuff[i+3]>clk)
405 phaseoff = tmpbuff[i+3]-clk;
406 else
407 phaseoff = 0;
408 // now do it again to find the end
409 end = skip;
410 for (i += 3; i < j - 4 ; ++i) {
411 end += tmpbuff[i];
412 if (tmpbuff[i] >= clk*3-tol && tmpbuff[i] <= clk*3+tol) //3 clocks
413 if (tmpbuff[i+1] >= clk*2-tol && tmpbuff[i+1] <= clk*2+tol) //2 clocks
414 if (tmpbuff[i+2] >= clk*3-tol && tmpbuff[i+2] <= clk*3+tol) //3 clocks
415 if (tmpbuff[i+3] >= clk-tol) //1.5 to 2 clocks - depends on bit following
416 {
417 complete= true;
418 break;
419 }
420 }
421 end = i;
422 // report back
423 if (verbose || g_debugMode) {
424 if (start >= 0) {
425 PrintAndLog("\nNote: one block = 50 bits (32 data, 12 parity, 6 marker)");
426 } else {
427 PrintAndLog("No data found!, clock tried:%d",clk);
428 PrintAndLog("Try again with more samples.");
429 PrintAndLog(" or after a 'data askedge' command to clean up the read");
430 return 0;
431 }
432 } else if (start < 0) return 0;
433 start = skip;
434 snprintf(tmp2, sizeof(tmp2),"%d %d 1000 %d", clk, invert, clk*47);
435 // get rid of leading crap
436 snprintf(tmp, sizeof(tmp), "%i", skip);
437 CmdLtrim(tmp);
438 bool pTest;
439 bool AllPTest = true;
440 // now work through remaining buffer printing out data blocks
441 block = 0;
442 i = startblock;
443 while (block < 6) {
444 if (verbose || g_debugMode) PrintAndLog("\nBlock %i:", block);
445 skip = phaseoff;
446
447 // look for LW before start of next block
448 for ( ; i < j - 4 ; ++i) {
449 skip += tmpbuff[i];
450 if (tmpbuff[i] >= clk*3-tol && tmpbuff[i] <= clk*3+tol)
451 if (tmpbuff[i+1] >= clk-tol)
452 break;
453 }
454 if (i >= j-4) break; //next LW not found
455 skip += clk;
456 if (tmpbuff[i+1]>clk)
457 phaseoff = tmpbuff[i+1]-clk;
458 else
459 phaseoff = 0;
460 i += 2;
461 if (ASKDemod(tmp2, false, false, 1) < 1) {
462 save_restoreGB(0);
463 return 0;
464 }
465 //set DemodBufferLen to just one block
466 DemodBufferLen = skip/clk;
467 //test parities
468 pTest = EM_ByteParityTest(DemodBuffer,DemodBufferLen,5,9,0);
469 pTest &= EM_EndParityTest(DemodBuffer,DemodBufferLen,5,9,0);
470 AllPTest &= pTest;
471 //get output
472 Code[block] = OutputEM4x50_Block(DemodBuffer,DemodBufferLen,verbose, pTest);
473 if (g_debugMode) PrintAndLog("\nskipping %d samples, bits:%d", skip, skip/clk);
474 //skip to start of next block
475 snprintf(tmp,sizeof(tmp),"%i",skip);
476 CmdLtrim(tmp);
477 block++;
478 if (i >= end) break; //in case chip doesn't output 6 blocks
479 }
480 //print full code:
481 if (verbose || g_debugMode || AllPTest){
482 if (!complete) {
483 PrintAndLog("*** Warning!");
484 PrintAndLog("Partial data - no end found!");
485 PrintAndLog("Try again with more samples.");
486 }
487 PrintAndLog("Found data at sample: %i - using clock: %i", start, clk);
488 end = block;
489 for (block=0; block < end; block++){
490 PrintAndLog("Block %d: %08x",block,Code[block]);
491 }
492 if (AllPTest) {
493 PrintAndLog("Parities Passed");
494 } else {
495 PrintAndLog("Parities Failed");
496 PrintAndLog("Try cleaning the read samples with 'data askedge'");
497 }
498 }
499
500 //restore GraphBuffer
501 save_restoreGB(0);
502 return (int)AllPTest;
503 }
504
505 int CmdEM4x50Read(const char *Cmd)
506 {
507 return EM4x50Read(Cmd, true);
508 }
509
510 int CmdReadWord(const char *Cmd)
511 {
512 int Word = -1; //default to invalid word
513 UsbCommand c;
514
515 sscanf(Cmd, "%d", &Word);
516
517 if ( (Word > 15) | (Word < 0) ) {
518 PrintAndLog("Word must be between 0 and 15");
519 return 1;
520 }
521
522 PrintAndLog("Reading word %d", Word);
523
524 c.cmd = CMD_EM4X_READ_WORD;
525 c.d.asBytes[0] = 0x0; //Normal mode
526 c.arg[0] = 0;
527 c.arg[1] = Word;
528 c.arg[2] = 0;
529 SendCommand(&c);
530 return 0;
531 }
532
533 int CmdReadWordPWD(const char *Cmd)
534 {
535 int Word = -1; //default to invalid word
536 int Password = 0xFFFFFFFF; //default to blank password
537 UsbCommand c;
538
539 sscanf(Cmd, "%d %x", &Word, &Password);
540
541 if ( (Word > 15) | (Word < 0) ) {
542 PrintAndLog("Word must be between 0 and 15");
543 return 1;
544 }
545
546 PrintAndLog("Reading word %d with password %08X", Word, Password);
547
548 c.cmd = CMD_EM4X_READ_WORD;
549 c.d.asBytes[0] = 0x1; //Password mode
550 c.arg[0] = 0;
551 c.arg[1] = Word;
552 c.arg[2] = Password;
553 SendCommand(&c);
554 return 0;
555 }
556
557 int CmdWriteWord(const char *Cmd)
558 {
559 int Word = 16; //default to invalid block
560 int Data = 0xFFFFFFFF; //default to blank data
561 UsbCommand c;
562
563 sscanf(Cmd, "%x %d", &Data, &Word);
564
565 if (Word > 15) {
566 PrintAndLog("Word must be between 0 and 15");
567 return 1;
568 }
569
570 PrintAndLog("Writing word %d with data %08X", Word, Data);
571
572 c.cmd = CMD_EM4X_WRITE_WORD;
573 c.d.asBytes[0] = 0x0; //Normal mode
574 c.arg[0] = Data;
575 c.arg[1] = Word;
576 c.arg[2] = 0;
577 SendCommand(&c);
578 return 0;
579 }
580
581 int CmdWriteWordPWD(const char *Cmd)
582 {
583 int Word = 16; //default to invalid word
584 int Data = 0xFFFFFFFF; //default to blank data
585 int Password = 0xFFFFFFFF; //default to blank password
586 UsbCommand c;
587
588 sscanf(Cmd, "%x %d %x", &Data, &Word, &Password);
589
590 if (Word > 15) {
591 PrintAndLog("Word must be between 0 and 15");
592 return 1;
593 }
594
595 PrintAndLog("Writing word %d with data %08X and password %08X", Word, Data, Password);
596
597 c.cmd = CMD_EM4X_WRITE_WORD;
598 c.d.asBytes[0] = 0x1; //Password mode
599 c.arg[0] = Data;
600 c.arg[1] = Word;
601 c.arg[2] = Password;
602 SendCommand(&c);
603 return 0;
604 }
605
606 static command_t CommandTable[] =
607 {
608 {"help", CmdHelp, 1, "This help"},
609 {"em410xdemod", CmdEMdemodASK, 0, "[findone] -- Extract ID from EM410x tag (option 0 for continuous loop, 1 for only 1 tag)"},
610 {"em410xread", CmdEM410xRead, 1, "[clock rate] -- Extract ID from EM410x tag in GraphBuffer"},
611 {"em410xsim", CmdEM410xSim, 0, "<UID> -- Simulate EM410x tag"},
612 {"em410xwatch", CmdEM410xWatch, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"},
613 {"em410xspoof", CmdEM410xWatchnSpoof, 0, "['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)" },
614 {"em410xwrite", CmdEM410xWrite, 0, "<UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"},
615 {"em4x50read", CmdEM4x50Read, 1, "Extract data from EM4x50 tag"},
616 {"readword", CmdReadWord, 1, "<Word> -- Read EM4xxx word data"},
617 {"readwordPWD", CmdReadWordPWD, 1, "<Word> <Password> -- Read EM4xxx word data in password mode"},
618 {"writeword", CmdWriteWord, 1, "<Data> <Word> -- Write EM4xxx word data"},
619 {"writewordPWD", CmdWriteWordPWD, 1, "<Data> <Word> <Password> -- Write EM4xxx word data in password mode"},
620 {NULL, NULL, 0, NULL}
621 };
622
623 int CmdLFEM4X(const char *Cmd)
624 {
625 CmdsParse(CommandTable, Cmd);
626 return 0;
627 }
628
629 int CmdHelp(const char *Cmd)
630 {
631 CmdsHelp(CommandTable);
632 return 0;
633 }
Impressum, Datenschutz