]> cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfem4x.c
a0cd87caaeef47a89d5987a8ae072addfa7804f7
[proxmark3-svn] / client / cmdlfem4x.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // Low frequency EM4x commands
9 //-----------------------------------------------------------------------------
10
11 #include <stdio.h>
12 #include <string.h>
13 #include <inttypes.h>
14 #include "proxmark3.h"
15 #include "ui.h"
16 #include "graph.h"
17 #include "cmdmain.h"
18 #include "cmdparser.h"
19 #include "cmddata.h"
20 #include "cmdlf.h"
21 #include "cmdlfem4x.h"
22 #include "util.h"
23 #include "data.h"
24 #define LF_TRACE_BUFF_SIZE 12000
25 #define LF_BITSSTREAM_LEN 1000
26
27 char *global_em410xId;
28
29 static int CmdHelp(const char *Cmd);
30
31 int CmdEMdemodASK(const char *Cmd)
32 {
33 char cmdp = param_getchar(Cmd, 0);
34 int findone = (cmdp == '1') ? 1 : 0;
35 UsbCommand c = { CMD_EM410X_DEMOD };
36 c.arg[0] = findone;
37 SendCommand(&c);
38 return 0;
39 }
40
41 /* Read the ID of an EM410x tag.
42 * Format:
43 * 1111 1111 1 <-- standard non-repeatable header
44 * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
45 * ....
46 * CCCC <-- each bit here is parity for the 10 bits above in corresponding column
47 * 0 <-- stop bit, end of tag
48 */
49 int CmdEM410xRead(const char *Cmd)
50 {
51 int i, j, clock, header, rows, bit, hithigh, hitlow, first, bit2idx, high, low;
52 int parity[4];
53 char id[11] = {0x00};
54 char id2[11] = {0x00};
55 int retested = 0;
56 uint8_t BitStream[MAX_GRAPH_TRACE_LEN];
57 high = low = 0;
58
59 // get clock
60 clock = GetClock(Cmd, 0);
61
62 // Detect high and lows and clock
63 DetectHighLowInGraph( &high, &low, TRUE);
64
65 PrintAndLog("NUMNUM");
66
67 // parity for our 4 columns
68 parity[0] = parity[1] = parity[2] = parity[3] = 0;
69 header = rows = 0;
70
71 // manchester demodulate
72 bit = bit2idx = 0;
73 for (i = 0; i < (int)(GraphTraceLen / clock); i++)
74 {
75 hithigh = 0;
76 hitlow = 0;
77 first = 1;
78
79 /* Find out if we hit both high and low peaks */
80 for (j = 0; j < clock; j++)
81 {
82 if (GraphBuffer[(i * clock) + j] >= high)
83 hithigh = 1;
84 else if (GraphBuffer[(i * clock) + j] <= low)
85 hitlow = 1;
86
87 /* it doesn't count if it's the first part of our read
88 because it's really just trailing from the last sequence */
89 if (first && (hithigh || hitlow))
90 hithigh = hitlow = 0;
91 else
92 first = 0;
93
94 if (hithigh && hitlow)
95 break;
96 }
97
98 /* If we didn't hit both high and low peaks, we had a bit transition */
99 if (!hithigh || !hitlow)
100 bit ^= 1;
101
102 BitStream[bit2idx++] = bit;
103 }
104
105 retest:
106 /* We go till 5 before the graph ends because we'll get that far below */
107 for (i = 0; i < bit2idx - 5; i++)
108 {
109 /* Step 2: We have our header but need our tag ID */
110 if (header == 9 && rows < 10)
111 {
112 /* Confirm parity is correct */
113 if ((BitStream[i] ^ BitStream[i+1] ^ BitStream[i+2] ^ BitStream[i+3]) == BitStream[i+4])
114 {
115 /* Read another byte! */
116 sprintf(id+rows, "%x", (8 * BitStream[i]) + (4 * BitStream[i+1]) + (2 * BitStream[i+2]) + (1 * BitStream[i+3]));
117 sprintf(id2+rows, "%x", (8 * BitStream[i+3]) + (4 * BitStream[i+2]) + (2 * BitStream[i+1]) + (1 * BitStream[i]));
118 rows++;
119
120 /* Keep parity info */
121 parity[0] ^= BitStream[i];
122 parity[1] ^= BitStream[i+1];
123 parity[2] ^= BitStream[i+2];
124 parity[3] ^= BitStream[i+3];
125
126 /* Move 4 bits ahead */
127 i += 4;
128 }
129
130 /* Damn, something wrong! reset */
131 else
132 {
133 PrintAndLog("Thought we had a valid tag but failed at word %d (i=%d)", rows + 1, i);
134
135 /* Start back rows * 5 + 9 header bits, -1 to not start at same place */
136 i -= 9 + (5 * rows) -5;
137
138 rows = header = 0;
139 }
140 }
141
142 /* Step 3: Got our 40 bits! confirm column parity */
143 else if (rows == 10)
144 {
145 /* We need to make sure our 4 bits of parity are correct and we have a stop bit */
146 if (BitStream[i] == parity[0] && BitStream[i+1] == parity[1] &&
147 BitStream[i+2] == parity[2] && BitStream[i+3] == parity[3] &&
148 BitStream[i+4] == 0)
149 {
150 /* Sweet! */
151 PrintAndLog("EM410x Tag ID: %s", id);
152 PrintAndLog("Unique Tag ID: %s", id2);
153
154 global_em410xId = id;
155
156 /* Stop any loops */
157 return 1;
158 }
159
160 /* Crap! Incorrect parity or no stop bit, start all over */
161 else
162 {
163 rows = header = 0;
164
165 /* Go back 59 bits (9 header bits + 10 rows at 4+1 parity) */
166 i -= 59;
167 }
168 }
169
170 /* Step 1: get our header */
171 else if (header < 9)
172 {
173 /* Need 9 consecutive 1's */
174 if (BitStream[i] == 1)
175 header++;
176
177 /* We don't have a header, not enough consecutive 1 bits */
178 else
179 header = 0;
180 }
181 }
182
183 /* if we've already retested after flipping bits, return */
184 if (retested++){
185 PrintAndLog("Failed to decode");
186 return 0;
187 }
188
189 /* if this didn't work, try flipping bits */
190 for (i = 0; i < bit2idx; i++)
191 BitStream[i] ^= 1;
192
193 goto retest;
194 }
195
196 /* emulate an EM410X tag
197 * Format:
198 * 1111 1111 1 <-- standard non-repeatable header
199 * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
200 * ....
201 * CCCC <-- each bit here is parity for the 10 bits above in corresponding column
202 * 0 <-- stop bit, end of tag
203 */
204 int CmdEM410xSim(const char *Cmd)
205 {
206 int i, n, j, binary[4], parity[4];
207
208 char cmdp = param_getchar(Cmd, 0);
209 uint8_t uid[5] = {0x00};
210
211 if (cmdp == 'h' || cmdp == 'H') {
212 PrintAndLog("Usage: lf em4x 410xsim <UID>");
213 PrintAndLog("");
214 PrintAndLog(" sample: lf em4x 410xsim 0F0368568B");
215 return 0;
216 }
217
218 if (param_gethex(Cmd, 0, uid, 10)) {
219 PrintAndLog("UID must include 10 HEX symbols");
220 return 0;
221 }
222
223 PrintAndLog("Starting simulating UID %02X%02X%02X%02X%02X", uid[0],uid[1],uid[2],uid[3],uid[4]);
224 PrintAndLog("Press pm3-button to about simulation");
225
226 /* clock is 64 in EM410x tags */
227 int clock = 64;
228
229 /* clear our graph */
230 ClearGraph(0);
231
232 /* write 9 start bits */
233 for (i = 0; i < 9; i++)
234 AppendGraph(0, clock, 1);
235
236 /* for each hex char */
237 parity[0] = parity[1] = parity[2] = parity[3] = 0;
238 for (i = 0; i < 10; i++)
239 {
240 /* read each hex char */
241 sscanf(&Cmd[i], "%1x", &n);
242 for (j = 3; j >= 0; j--, n/= 2)
243 binary[j] = n % 2;
244
245 /* append each bit */
246 AppendGraph(0, clock, binary[0]);
247 AppendGraph(0, clock, binary[1]);
248 AppendGraph(0, clock, binary[2]);
249 AppendGraph(0, clock, binary[3]);
250
251 /* append parity bit */
252 AppendGraph(0, clock, binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
253
254 /* keep track of column parity */
255 parity[0] ^= binary[0];
256 parity[1] ^= binary[1];
257 parity[2] ^= binary[2];
258 parity[3] ^= binary[3];
259 }
260
261 /* parity columns */
262 AppendGraph(0, clock, parity[0]);
263 AppendGraph(0, clock, parity[1]);
264 AppendGraph(0, clock, parity[2]);
265 AppendGraph(0, clock, parity[3]);
266
267 /* stop bit */
268 AppendGraph(1, clock, 0);
269
270 CmdLFSim("240"); //240 start_gap.
271 return 0;
272 }
273
274 /* Function is equivalent of lf read + data samples + em410xread
275 * looped until an EM410x tag is detected
276 *
277 * Why is CmdSamples("16000")?
278 * TBD: Auto-grow sample size based on detected sample rate. IE: If the
279 * rate gets lower, then grow the number of samples
280 * Changed by martin, 4000 x 4 = 16000,
281 * see http://www.proxmark.org/forum/viewtopic.php?pid=7235#p7235
282
283 */
284 int CmdEM410xWatch(const char *Cmd)
285 {
286 char cmdp = param_getchar(Cmd, 0);
287 int read_h = (cmdp == 'h');
288 do
289 {
290 if (ukbhit()) {
291 printf("\naborted via keyboard!\n");
292 break;
293 }
294
295 CmdLFRead(read_h ? "h" : "");
296 CmdSamples("6000");
297
298 } while (
299 !CmdEM410xRead("")
300 );
301 return 0;
302 }
303
304 int CmdEM410xWatchnSpoof(const char *Cmd)
305 {
306 CmdEM410xWatch(Cmd);
307 PrintAndLog("# Replaying : %s",global_em410xId);
308 CmdEM410xSim(global_em410xId);
309 return 0;
310 }
311
312 /* Read the transmitted data of an EM4x50 tag
313 * Format:
314 *
315 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
316 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
317 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
318 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
319 * CCCCCCCC <- column parity bits
320 * 0 <- stop bit
321 * LW <- Listen Window
322 *
323 * This pattern repeats for every block of data being transmitted.
324 * Transmission starts with two Listen Windows (LW - a modulated
325 * pattern of 320 cycles each (32/32/128/64/64)).
326 *
327 * Note that this data may or may not be the UID. It is whatever data
328 * is stored in the blocks defined in the control word First and Last
329 * Word Read values. UID is stored in block 32.
330 */
331 int CmdEM4x50Read(const char *Cmd)
332 {
333 int i, j, startblock, skip, block, start, end, low, high;
334 bool complete= false;
335 int tmpbuff[MAX_GRAPH_TRACE_LEN / 64];
336 char tmp[6];
337
338 high= low= 0;
339 memset(tmpbuff, 0, MAX_GRAPH_TRACE_LEN / 64);
340
341 /* first get high and low values */
342 for (i = 0; i < GraphTraceLen; i++)
343 {
344 if (GraphBuffer[i] > high)
345 high = GraphBuffer[i];
346 else if (GraphBuffer[i] < low)
347 low = GraphBuffer[i];
348 }
349
350 /* populate a buffer with pulse lengths */
351 i= 0;
352 j= 0;
353 while (i < GraphTraceLen)
354 {
355 // measure from low to low
356 while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
357 ++i;
358 start= i;
359 while ((GraphBuffer[i] < high) && (i<GraphTraceLen))
360 ++i;
361 while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
362 ++i;
363 if (j>=(MAX_GRAPH_TRACE_LEN/64)) {
364 break;
365 }
366 tmpbuff[j++]= i - start;
367 }
368
369 /* look for data start - should be 2 pairs of LW (pulses of 192,128) */
370 start= -1;
371 skip= 0;
372 for (i= 0; i < j - 4 ; ++i)
373 {
374 skip += tmpbuff[i];
375 if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
376 if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
377 if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
378 if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
379 {
380 start= i + 3;
381 break;
382 }
383 }
384 startblock= i + 3;
385
386 /* skip over the remainder of the LW */
387 skip += tmpbuff[i+1]+tmpbuff[i+2];
388 while (skip < MAX_GRAPH_TRACE_LEN && GraphBuffer[skip] > low)
389 ++skip;
390 skip += 8;
391
392 /* now do it again to find the end */
393 end= start;
394 for (i += 3; i < j - 4 ; ++i)
395 {
396 end += tmpbuff[i];
397 if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
398 if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
399 if (tmpbuff[i+2] >= 190 && tmpbuff[i+2] <= 194)
400 if (tmpbuff[i+3] >= 126 && tmpbuff[i+3] <= 130)
401 {
402 complete= true;
403 break;
404 }
405 }
406
407 if (start >= 0)
408 PrintAndLog("Found data at sample: %i",skip);
409 else
410 {
411 PrintAndLog("No data found!");
412 PrintAndLog("Try again with more samples.");
413 return 0;
414 }
415
416 if (!complete)
417 {
418 PrintAndLog("*** Warning!");
419 PrintAndLog("Partial data - no end found!");
420 PrintAndLog("Try again with more samples.");
421 }
422
423 /* get rid of leading crap */
424 sprintf(tmp,"%i",skip);
425 CmdLtrim(tmp);
426
427 /* now work through remaining buffer printing out data blocks */
428 block= 0;
429 i= startblock;
430 while (block < 6)
431 {
432 PrintAndLog("Block %i:", block);
433 // mandemod routine needs to be split so we can call it for data
434 // just print for now for debugging
435 CmdManchesterDemod("i 64");
436 skip= 0;
437 /* look for LW before start of next block */
438 for ( ; i < j - 4 ; ++i)
439 {
440 skip += tmpbuff[i];
441 if (tmpbuff[i] >= 190 && tmpbuff[i] <= 194)
442 if (tmpbuff[i+1] >= 126 && tmpbuff[i+1] <= 130)
443 break;
444 }
445 while (GraphBuffer[skip] > low)
446 ++skip;
447 skip += 8;
448 sprintf(tmp,"%i",skip);
449 CmdLtrim(tmp);
450 start += skip;
451 block++;
452 }
453 return 0;
454 }
455
456 int CmdEM410xWrite(const char *Cmd)
457 {
458 uint64_t id = 0xFFFFFFFFFFFFFFFF; // invalid id value
459 int card = 0xFF; // invalid card value
460 unsigned int clock = 0; // invalid clock value
461
462 sscanf(Cmd, "%" PRIx64 " %d %d", &id, &card, &clock);
463
464 // Check ID
465 if (id == 0xFFFFFFFFFFFFFFFF) {
466 PrintAndLog("Error! ID is required.\n");
467 return 0;
468 }
469 if (id >= 0x10000000000) {
470 PrintAndLog("Error! Given EM410x ID is longer than 40 bits.\n");
471 return 0;
472 }
473
474 // Check Card
475 if (card == 0xFF) {
476 PrintAndLog("Error! Card type required.\n");
477 return 0;
478 }
479 if (card < 0) {
480 PrintAndLog("Error! Bad card type selected.\n");
481 return 0;
482 }
483
484 // Check Clock
485 if (card == 1)
486 {
487 // Default: 64
488 if (clock == 0)
489 clock = 64;
490
491 // Allowed clock rates: 16, 32 and 64
492 if ((clock != 16) && (clock != 32) && (clock != 64)) {
493 PrintAndLog("Error! Clock rate %d not valid. Supported clock rates are 16, 32 and 64.\n", clock);
494 return 0;
495 }
496 }
497 else if (clock != 0)
498 {
499 PrintAndLog("Error! Clock rate is only supported on T55x7 tags.\n");
500 return 0;
501 }
502
503 if (card == 1) {
504 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64 " (clock rate: %d)", "T55x7", id, clock);
505 // NOTE: We really should pass the clock in as a separate argument, but to
506 // provide for backwards-compatibility for older firmware, and to avoid
507 // having to add another argument to CMD_EM410X_WRITE_TAG, we just store
508 // the clock rate in bits 8-15 of the card value
509 card = (card & 0xFF) | (((uint64_t)clock << 8) & 0xFF00);
510 }
511 else if (card == 0)
512 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64, "T5555", id, clock);
513 else {
514 PrintAndLog("Error! Bad card type selected.\n");
515 return 0;
516 }
517
518 UsbCommand c = {CMD_EM410X_WRITE_TAG, {card, (uint32_t)(id >> 32), (uint32_t)id}};
519 SendCommand(&c);
520
521 return 0;
522 }
523
524 int CmdReadWord(const char *Cmd)
525 {
526 int Word = -1; //default to invalid word
527 UsbCommand c;
528
529 sscanf(Cmd, "%d", &Word);
530
531 if ( (Word > 15) | (Word < 0) ) {
532 PrintAndLog("Word must be between 0 and 15");
533 return 1;
534 }
535
536 PrintAndLog("Reading word %d", Word);
537
538 c.cmd = CMD_EM4X_READ_WORD;
539 c.d.asBytes[0] = 0x0; //Normal mode
540 c.arg[0] = 0;
541 c.arg[1] = Word;
542 c.arg[2] = 0;
543 SendCommand(&c);
544 WaitForResponse(CMD_ACK, NULL);
545
546 uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
547
548 GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,0); //3560 -- should be offset..
549 WaitForResponseTimeout(CMD_ACK,NULL, 1500);
550
551 for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
552 GraphBuffer[j] = ((int)data[j]);
553 }
554 GraphTraceLen = LF_TRACE_BUFF_SIZE;
555
556 uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
557 uint8_t * bitstream = bits;
558 manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream,LF_BITSSTREAM_LEN);
559 RepaintGraphWindow();
560 return 0;
561 }
562
563 int CmdReadWordPWD(const char *Cmd)
564 {
565 int Word = -1; //default to invalid word
566 int Password = 0xFFFFFFFF; //default to blank password
567 UsbCommand c;
568
569 sscanf(Cmd, "%d %x", &Word, &Password);
570
571 if ( (Word > 15) | (Word < 0) ) {
572 PrintAndLog("Word must be between 0 and 15");
573 return 1;
574 }
575
576 PrintAndLog("Reading word %d with password %08X", Word, Password);
577
578 c.cmd = CMD_EM4X_READ_WORD;
579 c.d.asBytes[0] = 0x1; //Password mode
580 c.arg[0] = 0;
581 c.arg[1] = Word;
582 c.arg[2] = Password;
583 SendCommand(&c);
584 WaitForResponse(CMD_ACK, NULL);
585
586 uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
587
588 GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,0); //3560 -- should be offset..
589 WaitForResponseTimeout(CMD_ACK,NULL, 1500);
590
591 for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
592 GraphBuffer[j] = ((int)data[j]);
593 }
594 GraphTraceLen = LF_TRACE_BUFF_SIZE;
595
596 uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
597 uint8_t * bitstream = bits;
598 manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream, LF_BITSSTREAM_LEN);
599 RepaintGraphWindow();
600 return 0;
601 }
602
603 int CmdWriteWord(const char *Cmd)
604 {
605 int Word = 16; //default to invalid block
606 int Data = 0xFFFFFFFF; //default to blank data
607 UsbCommand c;
608
609 sscanf(Cmd, "%x %d", &Data, &Word);
610
611 if (Word > 15) {
612 PrintAndLog("Word must be between 0 and 15");
613 return 1;
614 }
615
616 PrintAndLog("Writing word %d with data %08X", Word, Data);
617
618 c.cmd = CMD_EM4X_WRITE_WORD;
619 c.d.asBytes[0] = 0x0; //Normal mode
620 c.arg[0] = Data;
621 c.arg[1] = Word;
622 c.arg[2] = 0;
623 SendCommand(&c);
624 return 0;
625 }
626
627 int CmdWriteWordPWD(const char *Cmd)
628 {
629 int Word = 16; //default to invalid word
630 int Data = 0xFFFFFFFF; //default to blank data
631 int Password = 0xFFFFFFFF; //default to blank password
632 UsbCommand c;
633
634 sscanf(Cmd, "%x %d %x", &Data, &Word, &Password);
635
636 if (Word > 15) {
637 PrintAndLog("Word must be between 0 and 15");
638 return 1;
639 }
640
641 PrintAndLog("Writing word %d with data %08X and password %08X", Word, Data, Password);
642
643 c.cmd = CMD_EM4X_WRITE_WORD;
644 c.d.asBytes[0] = 0x1; //Password mode
645 c.arg[0] = Data;
646 c.arg[1] = Word;
647 c.arg[2] = Password;
648 SendCommand(&c);
649 return 0;
650 }
651
652 static command_t CommandTable[] =
653 {
654 {"help", CmdHelp, 1, "This help"},
655 {"410xdemod", CmdEMdemodASK, 0, "[clock rate] -- Extract ID from EM410x tag"},
656 {"410xread", CmdEM410xRead, 1, "[clock rate] -- Extract ID from EM410x tag"},
657 {"410xsim", CmdEM410xSim, 0, "<UID> -- Simulate EM410x tag"},
658 {"replay", MWRem4xReplay, 0, "Watches for tag and simulates manchester encoded em4x tag"},
659 {"410xwatch", CmdEM410xWatch, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"},
660 {"410xspoof", CmdEM410xWatchnSpoof, 0, "['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)" },
661 {"410xwrite", CmdEM410xWrite, 1, "<UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"},
662 {"4x50read", CmdEM4x50Read, 1, "Extract data from EM4x50 tag"},
663 {"rd", CmdReadWord, 1, "<Word 1-15> -- Read EM4xxx word data"},
664 {"rdpwd", CmdReadWordPWD, 1, "<Word 1-15> <Password> -- Read EM4xxx word data in password mode "},
665 {"wr", CmdWriteWord, 1, "<Data> <Word 1-15> -- Write EM4xxx word data"},
666 {"wrpwd", CmdWriteWordPWD, 1, "<Data> <Word 1-15> <Password> -- Write EM4xxx word data in password mode"},
667 {NULL, NULL, 0, NULL}
668 };
669
670
671 //Confirms the parity of a bitstream as well as obtaining the data (TagID) from within the appropriate memory space.
672 //Arguments:
673 // Pointer to a string containing the desired bitsream
674 // Pointer to a string that will receive the decoded tag ID
675 // Length of the bitsream pointed at in the first argument, char* _strBitStream
676 //Retuns:
677 //1 Parity confirmed
678 //0 Parity not confirmed
679 int ConfirmEm410xTagParity( char* _strBitStream, char* pID, int LengthOfBitstream )
680 {
681 int i = 0;
682 int rows = 0;
683 int Parity[4] = {0x00};
684 char ID[11] = {0x00};
685 int k = 0;
686 int BitStream[70] = {0x00};
687 int counter = 0;
688 //prepare variables
689 for ( i = 0; i <= LengthOfBitstream; i++)
690 {
691 if (_strBitStream[i] == '1')
692 {
693 k =1;
694 memcpy(&BitStream[i], &k,4);
695 }
696 else if (_strBitStream[i] == '0')
697 {
698 k = 0;
699 memcpy(&BitStream[i], &k,4);
700 }
701 }
702 while ( counter < 2 )
703 {
704 //set/reset variables and counters
705 memset(ID,0x00,sizeof(ID));
706 memset(Parity,0x00,sizeof(Parity));
707 rows = 0;
708 for ( i = 9; i <= LengthOfBitstream; i++)
709 {
710 if ( rows < 10 )
711 {
712 if ((BitStream[i] ^ BitStream[i+1] ^ BitStream[i+2] ^ BitStream[i+3]) == BitStream[i+4])
713 {
714 sprintf(ID+rows, "%x", (8 * BitStream[i]) + (4 * BitStream[i+1]) + (2 * BitStream[i+2]) + (1 * BitStream[i+3]));
715 rows++;
716 /* Keep parity info and move four bits ahead*/
717 Parity[0] ^= BitStream[i];
718 Parity[1] ^= BitStream[i+1];
719 Parity[2] ^= BitStream[i+2];
720 Parity[3] ^= BitStream[i+3];
721 i += 4;
722 }
723 }
724 if ( rows == 10 )
725 {
726 if ( BitStream[i] == Parity[0] && BitStream[i+1] == Parity[1] &&
727 BitStream[i+2] == Parity[2] && BitStream[i+3] == Parity[3] &&
728 BitStream[i+4] == 0)
729 {
730 memcpy(pID,ID,strlen(ID));
731 return 1;
732 }
733 }
734 }
735 printf("[PARITY ->]Failed. Flipping Bits, and rechecking parity for bitstream:\n[PARITY ->]");
736 for (k = 0; k < LengthOfBitstream; k++)
737 {
738 BitStream[k] ^= 1;
739 printf("%i", BitStream[k]);
740 }
741 puts(" ");
742 counter++;
743 }
744 return 0;
745 }
746 //Reads and demodulates an em410x RFID tag. It further allows slight modification to the decoded bitstream
747 //Once a suitable bitstream has been identified, and if needed, modified, it is replayed. Allowing emulation of the
748 //"stolen" rfid tag.
749 //No meaningful returns or arguments.
750 int MWRem4xReplay(const char* Cmd)
751 {
752 // //header traces
753 // static char ArrayTraceZero[] = { '0','0','0','0','0','0','0','0','0' };
754 // static char ArrayTraceOne[] = { '1','1','1','1','1','1','1','1','1' };
755 // //local string variables
756 // char strClockRate[10] = {0x00};
757 // char strAnswer[4] = {0x00};
758 // char strTempBufferMini[2] = {0x00};
759 // //our outbound bit-stream
760 // char strSimulateBitStream[65] = {0x00};
761 // //integers
762 // int iClockRate = 0;
763 // int needle = 0;
764 // int j = 0;
765 // int iFirstHeaderOffset = 0x00000000;
766 // int numManchesterDemodBits=0;
767 // //boolean values
768 // bool bInverted = false;
769 // //pointers to strings. memory will be allocated.
770 // char* pstrInvertBitStream = 0x00000000;
771 // char* pTempBuffer = 0x00000000;
772 // char* pID = 0x00000000;
773 // char* strBitStreamBuffer = 0x00000000;
774
775
776 // puts("###################################");
777 // puts("#### Em4x Replay ##");
778 // puts("#### R.A.M. June 2013 ##");
779 // puts("###################################");
780 // //initialize
781 // CmdLFRead("");
782 // //Collect ourselves 10,000 samples
783 // CmdSamples("10000");
784 // puts("[->]preforming ASK demodulation\n");
785 // //demodulate ask
786 // Cmdaskdemod("0");
787 // iClockRate = DetectClock(0);
788 // sprintf(strClockRate, "%i\n",iClockRate);
789 // printf("[->]Detected ClockRate: %s\n", strClockRate);
790
791 // //If detected clock rate is something completely unreasonable, dont go ahead
792 // if ( iClockRate < 0xFFFE )
793 // {
794 // pTempBuffer = (char*)malloc(MAX_GRAPH_TRACE_LEN);
795 // if (pTempBuffer == 0x00000000)
796 // return 0;
797 // memset(pTempBuffer,0x00,MAX_GRAPH_TRACE_LEN);
798 // //Preform manchester de-modulation and display in a single line.
799 // numManchesterDemodBits = CmdManchesterDemod( strClockRate );
800 // //note: numManchesterDemodBits is set above in CmdManchesterDemod()
801 // if ( numManchesterDemodBits == 0 )
802 // return 0;
803 // strBitStreamBuffer = malloc(numManchesterDemodBits+1);
804 // if ( strBitStreamBuffer == 0x00000000 )
805 // return 0;
806 // memset(strBitStreamBuffer, 0x00, (numManchesterDemodBits+1));
807 // //fill strBitStreamBuffer with demodulated, string formatted bits.
808 // for ( j = 0; j <= numManchesterDemodBits; j++ )
809 // {
810 // sprintf(strTempBufferMini, "%i",BitStream[j]);
811 // strcat(strBitStreamBuffer,strTempBufferMini);
812 // }
813 // printf("[->]Demodulated Bitstream: \n%s\n", strBitStreamBuffer);
814 // //Reset counter and select most probable bit stream
815 // j = 0;
816 // while ( j < numManchesterDemodBits )
817 // {
818 // memset(strSimulateBitStream,0x00,64);
819 // //search for header of nine (9) 0's : 000000000 or nine (9) 1's : 1111 1111 1
820 // if ( ( strncmp(strBitStreamBuffer+j, ArrayTraceZero, sizeof(ArrayTraceZero)) == 0 ) ||
821 // ( strncmp(strBitStreamBuffer+j, ArrayTraceOne, sizeof(ArrayTraceOne)) == 0 ) )
822 // {
823 // iFirstHeaderOffset = j;
824 // memcpy(strSimulateBitStream, strBitStreamBuffer+j,64);
825 // printf("[->]Offset of Header");
826 // if ( strncmp(strBitStreamBuffer+iFirstHeaderOffset, "0", 1) == 0 )
827 // printf("'%s'", ArrayTraceZero );
828 // else
829 // printf("'%s'", ArrayTraceOne );
830 // printf(": %i\nHighlighted string : %s\n",iFirstHeaderOffset,strSimulateBitStream);
831 // //allow us to escape loop or choose another frame
832 // puts("[<-]Are we happy with this sample? [Y]es/[N]o");
833 // gets(strAnswer);
834 // if ( ( strncmp(strAnswer,"y",1) == 0 ) || ( strncmp(strAnswer,"Y",1) == 0 ) )
835 // {
836 // j = numManchesterDemodBits+1;
837 // break;
838 // }
839 // }
840 // j++;
841 // }
842 // }
843 // else return 0;
844
845 // //Do we want the buffer inverted?
846 // memset(strAnswer, 0x00, sizeof(strAnswer));
847 // printf("[<-]Do you wish to invert the highlighted bitstream? [Y]es/[N]o\n");
848 // gets(strAnswer);
849 // if ( ( strncmp("y", strAnswer,1) == 0 ) || ( strncmp("Y", strAnswer, 1 ) == 0 ) )
850 // {
851 // //allocate heap memory
852 // pstrInvertBitStream = (char*)malloc(numManchesterDemodBits);
853 // if ( pstrInvertBitStream != 0x00000000 )
854 // {
855 // memset(pstrInvertBitStream,0x00,numManchesterDemodBits);
856 // bInverted = true;
857 // //Invert Bitstream
858 // for ( needle = 0; needle <= numManchesterDemodBits; needle++ )
859 // {
860 // if (strSimulateBitStream[needle] == '0')
861 // strcat(pstrInvertBitStream,"1");
862 // else if (strSimulateBitStream[needle] == '1')
863 // strcat(pstrInvertBitStream,"0");
864 // }
865 // printf("[->]Inverted bitstream: %s\n", pstrInvertBitStream);
866 // }
867 // }
868 // //Confirm parity of selected string
869 // pID = (char*)malloc(11);
870 // if (pID != 0x00000000)
871 // {
872 // memset(pID, 0x00, 11);
873 // if (ConfirmEm410xTagParity(strSimulateBitStream,pID, 64) == 1)
874 // {
875 // printf("[->]Parity confirmed for selected bitstream!\n");
876 // printf("[->]Tag ID was detected as: [hex]:%s\n",pID );
877 // }
878 // else
879 // printf("[->]Parity check failed for the selected bitstream!\n");
880 // }
881
882 // //Spoof
883 // memset(strAnswer, 0x00, sizeof(strAnswer));
884 // printf("[<-]Do you wish to continue with the EM4x simulation? [Y]es/[N]o\n");
885 // gets(strAnswer);
886 // if ( ( strncmp(strAnswer,"y",1) == 0 ) || ( strncmp(strAnswer,"Y",1) == 0 ) )
887 // {
888 // strcat(pTempBuffer, strClockRate);
889 // strcat(pTempBuffer, " ");
890 // if (bInverted == true)
891 // strcat(pTempBuffer,pstrInvertBitStream);
892 // if (bInverted == false)
893 // strcat(pTempBuffer,strSimulateBitStream);
894 // //inform the user
895 // puts("[->]Starting simulation now: \n");
896 // //Simulate tag with prepared buffer.
897 // CmdLFSimManchester(pTempBuffer);
898 // }
899 // else if ( ( strcmp("n", strAnswer) == 0 ) || ( strcmp("N", strAnswer ) == 0 ) )
900 // printf("[->]Exiting procedure now...\n");
901 // else
902 // printf("[->]Erroneous selection\nExiting procedure now....\n");
903
904 // //Clean up -- Exit function
905 // //clear memory, then release pointer.
906 // if ( pstrInvertBitStream != 0x00000000 )
907 // {
908 // memset(pstrInvertBitStream,0x00,numManchesterDemodBits);
909 // free(pstrInvertBitStream);
910 // }
911 // if ( pTempBuffer != 0x00000000 )
912 // {
913 // memset(pTempBuffer,0x00,MAX_GRAPH_TRACE_LEN);
914 // free(pTempBuffer);
915 // }
916 // if ( pID != 0x00000000 )
917 // {
918 // memset(pID,0x00,11);
919 // free(pID);
920 // }
921 // if ( strBitStreamBuffer != 0x00000000 )
922 // {
923 // memset(strBitStreamBuffer,0x00,numManchesterDemodBits);
924 // free(strBitStreamBuffer);
925 // }
926 return 0;
927 }
928
929 int CmdLFEM4X(const char *Cmd)
930 {
931 CmdsParse(CommandTable, Cmd);
932 return 0;
933 }
934
935 int CmdHelp(const char *Cmd)
936 {
937 CmdsHelp(CommandTable);
938 return 0;
939 }
Impressum, Datenschutz