cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlft55xx.c

   1 //-----------------------------------------------------------------------------
   2 //
   3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   4 // at your option, any later version. See the LICENSE.txt file for the text of
   5 // the license.
   6 //-----------------------------------------------------------------------------
   7 // Low frequency T55xx commands
   8 //-----------------------------------------------------------------------------
   9
  10 #include <stdio.h>
  11 #include <string.h>
  12 #include <inttypes.h>
  13 #include "proxmark3.h"
  14 #include "ui.h"
  15 #include "graph.h"
  16 #include "cmdmain.h"
  17 #include "cmdparser.h"
  18 #include "cmddata.h"
  19 #include "cmdlf.h"
  20 #include "cmdlft55xx.h"
  21 #include "util.h"
  22 #include "data.h"
  23
  24
  25 #define LF_TRACE_BUFF_SIZE 12000 // 32 x 32 x 10  (32 bit times numofblock (7), times clock skip..)
  26 static int CmdHelp(const char *Cmd);
  27
  28
  29 int CmdReadBlk(const char *Cmd)
  30 {
  31         //default to invalid block
  32         int Block = -1;
  33         UsbCommand c;
  34
  35         sscanf(Cmd, "%d", &Block);
  36
  37         if ((Block > 7) | (Block < 0)) {
  38                 PrintAndLog("Block must be between 0 and 7");
  39                 return 1;
  40         }
  41
  42         //PrintAndLog(" Reading page 0 block : %d", Block);
  43
  44         // this command fills up BigBuff
  45         //
  46         c.cmd = CMD_T55XX_READ_BLOCK;
  47         c.d.asBytes[0] = 0x00;
  48         c.arg[0] = 0;
  49         c.arg[1] = Block;
  50         c.arg[2] = 0;
  51         SendCommand(&c);
  52         WaitForResponse(CMD_ACK, NULL);
  53
  54         uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
  55
  56         GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560);  //3560 -- should be offset..
  57         WaitForResponseTimeout(CMD_ACK,NULL, 1500);
  58
  59         for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
  60                 GraphBuffer[j] = ((int)data[j]) ;
  61         }
  62         GraphTraceLen = LF_TRACE_BUFF_SIZE;
  63
  64         uint8_t bits[1000] = {0x00};
  65         uint8_t * bitstream = bits;
  66
  67         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream);
  68
  69         uint32_t bl0     = PackBits(5, 32, bitstream);
  70         PrintAndLog("     Block %d  : 0x%08X  %s", Block, bl0, sprint_bin(bitstream+5,32) );
  71
  72         RepaintGraphWindow();
  73   return 0;
  74 }
  75
  76 int CmdReadBlkPWD(const char *Cmd)
  77 {
  78         int Block = -1; //default to invalid block
  79         int Password = 0xFFFFFFFF; //default to blank Block 7
  80         UsbCommand c;
  81
  82         sscanf(Cmd, "%d %x", &Block, &Password);
  83
  84         if ((Block > 7) | (Block < 0)) {
  85                 PrintAndLog("Block must be between 0 and 7");
  86                 return 1;
  87         }
  88
  89         PrintAndLog("Reading page 0 block %d pwd %08X", Block, Password);
  90
  91         c.cmd = CMD_T55XX_READ_BLOCK;
  92         c.d.asBytes[0] = 0x1; //Password mode
  93         c.arg[0] = 0;
  94         c.arg[1] = Block;
  95         c.arg[2] = Password;
  96         SendCommand(&c);
  97         WaitForResponse(CMD_ACK, NULL);
  98
  99         uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
 100
 101         GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560);  //3560 -- should be offset..
 102         WaitForResponseTimeout(CMD_ACK,NULL, 1500);
 103
 104         for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
 105                 GraphBuffer[j] = ((int)data[j]) - 128;
 106         }
 107         GraphTraceLen = LF_TRACE_BUFF_SIZE;
 108
 109         uint8_t bits[1000] = {0x00};
 110         uint8_t * bitstream = bits;
 111
 112         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream);
 113
 114         uint32_t bl0     = PackBits(5, 32, bitstream);
 115         PrintAndLog("     Block %d  : 0x%08X  %s", Block, bl0, sprint_bin(bitstream+5,32) );
 116
 117         RepaintGraphWindow();
 118   return 0;
 119 }
 120
 121 int CmdWriteBlk(const char *Cmd)
 122 {
 123   int Block = 8; //default to invalid block
 124   int Data = 0xFFFFFFFF; //default to blank Block
 125   UsbCommand c;
 126
 127   sscanf(Cmd, "%x %d", &Data, &Block);
 128
 129   if (Block > 7) {
 130         PrintAndLog("Block must be between 0 and 7");
 131         return 1;
 132   }
 133
 134   PrintAndLog("Writting block %d with data %08X", Block, Data);
 135
 136   c.cmd = CMD_T55XX_WRITE_BLOCK;
 137   c.d.asBytes[0] = 0x0; //Normal mode
 138   c.arg[0] = Data;
 139   c.arg[1] = Block;
 140   c.arg[2] = 0;
 141   SendCommand(&c);
 142   return 0;
 143 }
 144
 145 int CmdWriteBlkPWD(const char *Cmd)
 146 {
 147   int Block = 8; //default to invalid block
 148   int Data = 0xFFFFFFFF; //default to blank Block
 149   int Password = 0xFFFFFFFF; //default to blank Block 7
 150   UsbCommand c;
 151
 152   sscanf(Cmd, "%x %d %x", &Data, &Block, &Password);
 153
 154   if (Block > 7) {
 155         PrintAndLog("Block must be between 0 and 7");
 156         return 1;
 157   }
 158
 159   PrintAndLog("Writting block %d with data %08X and password %08X", Block, Data, Password);
 160
 161   c.cmd = CMD_T55XX_WRITE_BLOCK;
 162   c.d.asBytes[0] = 0x1; //Password mode
 163   c.arg[0] = Data;
 164   c.arg[1] = Block;
 165   c.arg[2] = Password;
 166   SendCommand(&c);
 167   return 0;
 168 }
 169
 170 int CmdReadTrace(const char *Cmd)
 171 {
 172         UsbCommand c = {CMD_T55XX_READ_TRACE, {0, 0, 0}};
 173         SendCommand(&c);
 174         WaitForResponse(CMD_ACK, NULL);
 175
 176         uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
 177
 178         GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560);  //3560 -- should be offset..
 179         WaitForResponseTimeout(CMD_ACK,NULL, 1500);
 180
 181         for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
 182                 GraphBuffer[j] = ((int)data[j]);
 183                 //GraphBuffer[j] = ((int)data[j]) - 128;
 184         }
 185         GraphTraceLen = LF_TRACE_BUFF_SIZE;
 186
 187         uint8_t bits[1000] = {0x00};
 188         uint8_t * bitstream = bits;
 189
 190         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream);
 191         RepaintGraphWindow();
 192
 193         uint8_t si = 5;
 194         uint32_t bl0     = PackBits(si, 32, bitstream);
 195         uint32_t bl1     = PackBits(si+32, 32, bitstream);
 196
 197         uint32_t acl     = PackBits(si,  8, bitstream); si += 8;
 198         uint32_t mfc     = PackBits(si, 8, bitstream); si += 8;
 199         uint32_t cid     = PackBits(si, 5, bitstream); si += 5;
 200         uint32_t icr     = PackBits(si, 3, bitstream); si += 3;
 201         uint32_t year    = PackBits(si, 4, bitstream); si += 4;
 202         uint32_t quarter = PackBits(si, 2, bitstream); si += 2;
 203         uint32_t lotid    = PackBits(si, 12, bitstream); si += 12;
 204         uint32_t wafer   = PackBits(si, 5, bitstream); si += 5;
 205         uint32_t dw      = PackBits(si, 15, bitstream);
 206
 207         PrintAndLog("");
 208         PrintAndLog("-- T55xx Trace Information ----------------------------------");
 209         PrintAndLog("-------------------------------------------------------------");
 210         PrintAndLog(" ACL Allocation class (ISO/IEC 15963-1)  : 0x%02X (%d)", acl, acl);
 211         PrintAndLog(" MFC Manufacturer ID (ISO/IEC 7816-6)    : 0x%02X (%d)", mfc, mfc);
 212         PrintAndLog(" CID                                     : 0x%02X (%d)", cid, cid);
 213         PrintAndLog(" ICR IC Revision                         : %d",icr );
 214         PrintAndLog(" Manufactured");
 215         PrintAndLog("     Year/Quarter : %d/%d",2000+year, quarter );
 216         PrintAndLog("     Lot ID       : %d", lotid );
 217         PrintAndLog("     Wafer number : %d", wafer);
 218         PrintAndLog("     Die Number   : %d", dw);
 219         PrintAndLog("-------------------------------------------------------------");
 220         PrintAndLog(" Raw Data - Page 1");
 221         PrintAndLog("     Block 0  : 0x%08X  %s", bl0, sprint_bin(bitstream+5,32) );
 222         PrintAndLog("     Block 0  : 0x%08X  %s", bl1, sprint_bin(bitstream+37,32) );
 223         PrintAndLog("-------------------------------------------------------------");
 224         /*
 225         TRACE - BLOCK O
 226                 Bits    Definition                                                              HEX
 227                 1-8             ACL Allocation class (ISO/IEC 15963-1)  0xE0
 228                 9-16    MFC Manufacturer ID (ISO/IEC 7816-6)    0x15 Atmel Corporation
 229                 17-21   CID                                                                             0x1 = Atmel ATA5577M1  0x2 = Atmel ATA5577M2
 230                 22-24   ICR IC revision
 231                 25-28   YEAR (BCD encoded)                                              9 (= 2009)
 232                 29-30   QUARTER                                                                 1,2,3,4
 233                 31-32   LOT ID
 234
 235         TRACE - BLOCK 1
 236                 1-12    LOT ID
 237                 13-17   Wafer number
 238                 18-32   DW,  die number sequential
 239         */
 240
 241   return 0;
 242 }
 243
 244 int CmdInfo(const char *Cmd){
 245         /*
 246                 Page 0 Block 0 Configuration data.
 247                 Normal mode
 248                 Extended mode
 249         */
 250         // läs block 0 -  data finns i graphbuff
 251         CmdReadBlk("0");
 252
 253         uint8_t bits[1000] = {0x00};
 254         uint8_t * bitstream = bits;
 255
 256         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream);
 257
 258         uint8_t si = 5;
 259         uint32_t bl0      = PackBits(si, 32, bitstream);
 260
 261         uint32_t safer    = PackBits(si, 4, bitstream); si += 4;
 262         uint32_t resv     = PackBits(si, 7, bitstream); si += 7;
 263         uint32_t dbr      = PackBits(si, 3, bitstream); si += 3;
 264         uint32_t extend   = PackBits(si, 1, bitstream); si += 1;
 265         uint32_t datamodulation   = PackBits(si, 5, bitstream); si += 5;
 266         uint32_t pskcf    = PackBits(si, 2, bitstream); si += 2;
 267         uint32_t aor      = PackBits(si, 1, bitstream); si += 1;
 268         uint32_t otp      = PackBits(si, 1, bitstream); si += 1;
 269         uint32_t maxblk   = PackBits(si, 3, bitstream); si += 3;
 270         uint32_t pwd      = PackBits(si, 1, bitstream); si += 1;
 271         uint32_t sst      = PackBits(si, 1, bitstream); si += 1;
 272         uint32_t fw       = PackBits(si, 1, bitstream); si += 1;
 273         uint32_t inv      = PackBits(si, 1, bitstream); si += 1;
 274         uint32_t por      = PackBits(si, 1, bitstream); si += 1;
 275
 276         PrintAndLog("");
 277         PrintAndLog("-- T55xx Configuration --------------------------------------");
 278         PrintAndLog("-------------------------------------------------------------");
 279         PrintAndLog(" Safer key                 : %s", GetSaferStr(safer));
 280         PrintAndLog(" reserved                  : %d", resv);
 281         PrintAndLog(" Data bit rate             : %s", GetBitRateStr(dbr));
 282         PrintAndLog(" eXtended mode             : %s", (extend) ? "Yes - Warning":"No");
 283         PrintAndLog(" Modulation                : %s", GetModulationStr(datamodulation) );
 284         PrintAndLog(" PSK clock freq            : %d", pskcf);
 285         PrintAndLog(" AOR - Answer on Request   : %s", (aor) ? "Yes":"No");
 286         PrintAndLog(" OTP - One Time Pad        : %s", (otp) ? "Yes - Warning":"No" );
 287         PrintAndLog(" Max block                 : %d", maxblk);
 288         PrintAndLog(" Password mode             : %s", (pwd) ? "Yes":"No");
 289         PrintAndLog(" Sequence Start Terminator : %s", (sst) ? "Yes":"No");
 290         PrintAndLog(" Fast Write                : %s", (fw) ? "Yes":"No");
 291         PrintAndLog(" Inverse data              : %s", (inv) ? "Yes":"No");
 292         PrintAndLog(" POR-Delay                 : %s", (por) ? "Yes":"No");
 293         PrintAndLog("-------------------------------------------------------------");
 294         PrintAndLog(" Raw Data - Page 0");
 295         PrintAndLog("     Block 0  : 0x%08X  %s", bl0, sprint_bin(bitstream+5,32) );
 296         PrintAndLog("-------------------------------------------------------------");
 297
 298         return 0;
 299 }
 300
 301 int CmdDump(const char *Cmd){
 302
 303         char cmdp = param_getchar(Cmd, 0);
 304         char s[20];
 305         uint8_t pwd[4] = {0x00};
 306
 307         if (strlen(Cmd)>1 || cmdp == 'h' || cmdp == 'H') {
 308                 PrintAndLog("Usage:  lf t55xx dump <password>");
 309                 PrintAndLog("        sample: lf t55xx dump FFFFFFFF");
 310                 return 0;
 311         }
 312
 313         bool hasPwd = ( strlen(Cmd) > 0);
 314
 315         if ( hasPwd ){
 316                 if (param_gethex(Cmd, 0, pwd, 4)) {
 317                         PrintAndLog("password must include 4 HEX symbols");
 318                         return 0;
 319                 }
 320         }
 321
 322         for ( int i = 0; i <8; ++i){
 323                 *s = 0;
 324                 if ( hasPwd ) {
 325                         sprintf(s,"%d %d", i, pwd);
 326                         CmdReadBlkPWD(s);
 327                 } else {
 328                         sprintf(s,"%d", i);
 329                         CmdReadBlk(s);
 330                 }
 331         }
 332         return 0;
 333 }
 334
 335 int CmdIceFsk(const char *Cmd){
 336         //uint8_t bits[1000] = {0x00};
 337         //uint8_t * bitstream = bits;
 338         iceFsk3(GraphBuffer, LF_TRACE_BUFF_SIZE);
 339
 340         RepaintGraphWindow();
 341         return 0;
 342 }
 343
 344 char * GetBitRateStr(uint32_t id){
 345         static char buf[40];
 346         char *retStr = buf;
 347                 switch (id){
 348                 case 0:
 349                         sprintf(retStr,"%d - RF/8",id);
 350                         break;
 351                 case 1:
 352                         sprintf(retStr,"%d - RF/16",id);
 353                         break;
 354                 case 2:
 355                         sprintf(retStr,"%d - RF/32",id);
 356                         break;
 357                 case 3:
 358                         sprintf(retStr,"%d - RF/40",id);
 359                         break;
 360                 case 4:
 361                         sprintf(retStr,"%d - RF/50",id);
 362                         break;
 363                 case 5:
 364                         sprintf(retStr,"%d - RF/64",id);
 365                         break;
 366                 case 6:
 367                         sprintf(retStr,"%d - RF/100",id);
 368                         break;
 369                 case 7:
 370                         sprintf(retStr,"%d - RF/128",id);
 371                         break;
 372                 default:
 373                         sprintf(retStr,"%d - (Unknown)",id);
 374                         break;
 375                 }
 376
 377         return buf;
 378 }
 379
 380 char * GetSaferStr(uint32_t id){
 381         static char buf[40];
 382         char *retStr = buf;
 383
 384         sprintf(retStr,"%d",id);
 385         if (id == 6) {
 386                 sprintf(retStr,"%d - pasdwd",id);
 387         }
 388         if (id == 9 ){
 389                 sprintf(retStr,"%d - testmode ",id);
 390         }
 391
 392         return buf;
 393 }
 394 char * GetModulationStr( uint32_t id){
 395         static char buf[40];
 396         char *retStr = buf;
 397
 398         switch (id){
 399                 case 0:
 400                         sprintf(retStr,"%d - DIRECT (ASK/NRZ)",id);
 401                         break;
 402                 case 1:
 403                         sprintf(retStr,"%d - PSK 1 phase change when input changes",id);
 404                         break;
 405                 case 2:
 406                         sprintf(retStr,"%d - PSK 2 phase change on bitclk if input high",id);
 407                         break;
 408                 case 3:
 409                         sprintf(retStr,"%d - PSK 3 phase change on rising edge of input",id);
 410                         break;
 411                 case 4:
 412                         sprintf(retStr,"%d - FSK 1 RF/8  RF/5",id);
 413                         break;
 414                 case 5:
 415                         sprintf(retStr,"%d - FSK 2 RF/8  RF/10",id);
 416                         break;
 417                 case 6:
 418                         sprintf(retStr,"%d - FSK 1a RF/5  RF/8",id);
 419                         break;
 420                 case 7:
 421                         sprintf(retStr,"%d - FSK 2a RF/10  RF/8",id);
 422                         break;
 423                 case 8:
 424                         sprintf(retStr,"%d - Manschester",id);
 425                         break;
 426                 case 16:
 427                         sprintf(retStr,"%d - Biphase",id);
 428                         break;
 429                 case 17:
 430                         sprintf(retStr,"%d - Reserved",id);
 431                         break;
 432                 default:
 433                         sprintf(retStr,"0x%02X (Unknown)",id);
 434                         break;
 435                 }
 436         return buf;
 437 }
 438
 439
 440 uint32_t PackBits(uint8_t start, uint8_t len, uint8_t* bits){
 441
 442         int i = start;
 443         int j = len-1;
 444         uint32_t tmp = 0;
 445         for (; j >= 0; --j, ++i){
 446                 tmp     |= bits[i] << j;
 447         }
 448         return tmp;
 449 }
 450
 451 static command_t CommandTable[] =
 452 {
 453   {"help",   CmdHelp,        1, "This help"},
 454   {"rd",     CmdReadBlk,     0, "<block> -- Read T55xx block data (page 0)"},
 455   {"rdPWD",  CmdReadBlkPWD,  0, "<block> <password> -- Read T55xx block data with password mode"},
 456   {"wr",     CmdWriteBlk,    0, "<data> <block> -- Write T55xx block data (page 0)"},
 457   {"wrPWD",  CmdWriteBlkPWD, 0, "<data> <block> <password> -- Write T55xx block data with password"},
 458   {"trace",  CmdReadTrace,   0, "Read T55xx traceability data (page 1 / blk 0-1)"},
 459   {"info",   CmdInfo,        0, "Read T55xx configuration data (page0 /blk 0)"},
 460   {"dump",   CmdDump,        0, "[password] Dump T55xx card block 0-7. optional with password"},
 461   {"fsk",    CmdIceFsk,      0, "FSK demod"},
 462   {NULL, NULL, 0, NULL}
 463 };
 464
 465 int CmdLFT55XX(const char *Cmd)
 466 {
 467   CmdsParse(CommandTable, Cmd);
 468   return 0;
 469 }
 470
 471 int CmdHelp(const char *Cmd)
 472 {
 473   CmdsHelp(CommandTable);
 474   return 0;
 475 }