1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // Low frequency commands
9 //-----------------------------------------------------------------------------
15 #include "proxmark3.h"
19 #include "cmdparser.h"
26 #include "cmdlfem4x.h"
27 #include "cmdlfhitag.h"
28 #include "cmdlft55xx.h"
29 #include "cmdlfpcf7931.h"
32 static int CmdHelp(const char *Cmd
);
34 /* send a command before reading */
35 int CmdLFCommandRead(const char *Cmd
)
41 UsbCommand c
= {CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K
};
42 sscanf(Cmd
, "%"lli
" %"lli
" %"lli
" %s %s", &c
.arg
[0], &c
.arg
[1], &c
.arg
[2],(char*)(&c
.d
.asBytes
),(char*)(&dummy
+1));
43 // in case they specified 'h'
44 strcpy((char *)&c
.d
.asBytes
+ strlen((char *)c
.d
.asBytes
), dummy
);
49 int CmdFlexdemod(const char *Cmd
)
52 for (i
= 0; i
< GraphTraceLen
; ++i
) {
53 if (GraphBuffer
[i
] < 0) {
62 for (start
= 0; start
< GraphTraceLen
- LONG_WAIT
; start
++) {
63 int first
= GraphBuffer
[start
];
64 for (i
= start
; i
< start
+ LONG_WAIT
; i
++) {
65 if (GraphBuffer
[i
] != first
) {
69 if (i
== (start
+ LONG_WAIT
)) {
73 if (start
== GraphTraceLen
- LONG_WAIT
) {
74 PrintAndLog("nothing to wait for");
78 GraphBuffer
[start
] = 2;
79 GraphBuffer
[start
+1] = -2;
80 uint8_t bits
[64] = {0x00};
84 for (bit
= 0; bit
< 64; bit
++) {
86 for (int j
= 0; j
< 16; j
++) {
87 sum
+= GraphBuffer
[i
++];
90 bits
[bit
] = (sum
> 0) ? 1 : 0;
92 PrintAndLog("bit %d sum %d", bit
, sum
);
95 for (bit
= 0; bit
< 64; bit
++) {
98 for (j
= 0; j
< 16; j
++) {
99 sum
+= GraphBuffer
[i
++];
101 if (sum
> 0 && bits
[bit
] != 1) {
102 PrintAndLog("oops1 at %d", bit
);
104 if (sum
< 0 && bits
[bit
] != 0) {
105 PrintAndLog("oops2 at %d", bit
);
109 // HACK writing back to graphbuffer.
110 GraphTraceLen
= 32*64;
113 for (bit
= 0; bit
< 64; bit
++) {
115 phase
= (bits
[bit
] == 0) ? 0 : 1;
118 for (j
= 0; j
< 32; j
++) {
119 GraphBuffer
[i
++] = phase
;
124 RepaintGraphWindow();
128 int CmdIndalaDemod(const char *Cmd
)
130 // Usage: recover 64bit UID by default, specify "224" as arg to recover a 224bit UID
136 // worst case with GraphTraceLen=64000 is < 4096
137 // under normal conditions it's < 2048
139 uint8_t rawbits
[4096];
141 int worst
= 0, worstPos
= 0;
142 // PrintAndLog("Expecting a bit less than %d raw bits", GraphTraceLen / 32);
143 for (i
= 0; i
< GraphTraceLen
-1; i
+= 2) {
145 if ((GraphBuffer
[i
] > GraphBuffer
[i
+ 1]) && (state
!= 1)) {
147 for (j
= 0; j
< count
- 8; j
+= 16) {
148 rawbits
[rawbit
++] = 0;
150 if ((abs(count
- j
)) > worst
) {
151 worst
= abs(count
- j
);
157 } else if ((GraphBuffer
[i
] < GraphBuffer
[i
+ 1]) && (state
!= 0)) {
159 for (j
= 0; j
< count
- 8; j
+= 16) {
160 rawbits
[rawbit
++] = 1;
162 if ((abs(count
- j
)) > worst
) {
163 worst
= abs(count
- j
);
173 PrintAndLog("Recovered %d raw bits, expected: %d", rawbit
, GraphTraceLen
/32);
174 PrintAndLog("worst metric (0=best..7=worst): %d at pos %d", worst
, worstPos
);
179 // Finding the start of a UID
180 int uidlen
, long_wait
;
181 if (strcmp(Cmd
, "224") == 0) {
191 for (start
= 0; start
<= rawbit
- uidlen
; start
++) {
192 first
= rawbits
[start
];
193 for (i
= start
; i
< start
+ long_wait
; i
++) {
194 if (rawbits
[i
] != first
) {
198 if (i
== (start
+ long_wait
)) {
203 if (start
== rawbit
- uidlen
+ 1) {
204 PrintAndLog("nothing to wait for");
208 // Inverting signal if needed
210 for (i
= start
; i
< rawbit
; i
++) {
211 rawbits
[i
] = !rawbits
[i
];
216 uint8_t bits
[224] = {0x00};
217 char showbits
[225] = {0x00};
222 if (uidlen
> rawbit
) {
223 PrintAndLog("Warning: not enough raw bits to get a full UID");
224 for (bit
= 0; bit
< rawbit
; bit
++) {
225 bits
[bit
] = rawbits
[i
++];
226 // As we cannot know the parity, let's use "." and "/"
227 showbits
[bit
] = '.' + bits
[bit
];
229 showbits
[bit
+1]='\0';
230 PrintAndLog("Partial UID=%s", showbits
);
233 for (bit
= 0; bit
< uidlen
; bit
++) {
234 bits
[bit
] = rawbits
[i
++];
235 showbits
[bit
] = '0' + bits
[bit
];
241 uint32_t uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
;
246 for( idx
=0; idx
<64; idx
++) {
247 if (showbits
[idx
] == '0') {
248 uid1
=(uid1
<<1)|(uid2
>>31);
251 uid1
=(uid1
<<1)|(uid2
>>31);
255 PrintAndLog("UID=%s (%x%08x)", showbits
, uid1
, uid2
);
258 uid3
= uid4
= uid5
= uid6
= uid7
= 0;
260 for( idx
=0; idx
<224; idx
++) {
261 uid1
=(uid1
<<1)|(uid2
>>31);
262 uid2
=(uid2
<<1)|(uid3
>>31);
263 uid3
=(uid3
<<1)|(uid4
>>31);
264 uid4
=(uid4
<<1)|(uid5
>>31);
265 uid5
=(uid5
<<1)|(uid6
>>31);
266 uid6
=(uid6
<<1)|(uid7
>>31);
268 if (showbits
[idx
] == '0')
269 uid7
= (uid7
<<1) | 0;
271 uid7
= (uid7
<<1) | 1;
273 PrintAndLog("UID=%s (%x%08x%08x%08x%08x%08x%08x)", showbits
, uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
);
276 // Checking UID against next occurrences
278 for (; i
+ uidlen
<= rawbit
;) {
280 for (bit
= 0; bit
< uidlen
; bit
++) {
281 if (bits
[bit
] != rawbits
[i
++]) {
292 PrintAndLog("Occurrences: %d (expected %d)", times
, (rawbit
- start
) / uidlen
);
294 // Remodulating for tag cloning
295 // HACK: 2015-01-04 this will have an impact on our new way of seening lf commands (demod)
296 // since this changes graphbuffer data.
297 GraphTraceLen
= 32*uidlen
;
300 for (bit
= 0; bit
< uidlen
; bit
++) {
301 if (bits
[bit
] == 0) {
307 for (j
= 0; j
< 32; j
++) {
308 GraphBuffer
[i
++] = phase
;
313 RepaintGraphWindow();
317 int CmdIndalaClone(const char *Cmd
)
320 unsigned int uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
;
322 uid1
= uid2
= uid3
= uid4
= uid5
= uid6
= uid7
= 0;
325 if (strchr(Cmd
,'l') != 0) {
326 while (sscanf(&Cmd
[i
++], "%1x", &n
) == 1) {
327 uid1
= (uid1
<< 4) | (uid2
>> 28);
328 uid2
= (uid2
<< 4) | (uid3
>> 28);
329 uid3
= (uid3
<< 4) | (uid4
>> 28);
330 uid4
= (uid4
<< 4) | (uid5
>> 28);
331 uid5
= (uid5
<< 4) | (uid6
>> 28);
332 uid6
= (uid6
<< 4) | (uid7
>> 28);
333 uid7
= (uid7
<< 4) | (n
& 0xf);
335 PrintAndLog("Cloning 224bit tag with UID %x%08x%08x%08x%08x%08x%08x", uid1
, uid2
, uid3
, uid4
, uid5
, uid6
, uid7
);
336 c
.cmd
= CMD_INDALA_CLONE_TAG_L
;
337 c
.d
.asDwords
[0] = uid1
;
338 c
.d
.asDwords
[1] = uid2
;
339 c
.d
.asDwords
[2] = uid3
;
340 c
.d
.asDwords
[3] = uid4
;
341 c
.d
.asDwords
[4] = uid5
;
342 c
.d
.asDwords
[5] = uid6
;
343 c
.d
.asDwords
[6] = uid7
;
345 while (sscanf(&Cmd
[i
++], "%1x", &n
) == 1) {
346 uid1
= (uid1
<< 4) | (uid2
>> 28);
347 uid2
= (uid2
<< 4) | (n
& 0xf);
349 PrintAndLog("Cloning 64bit tag with UID %x%08x", uid1
, uid2
);
350 c
.cmd
= CMD_INDALA_CLONE_TAG
;
361 PrintAndLog("Usage: lf read");
362 PrintAndLog("Options: ");
363 PrintAndLog(" h This help");
364 PrintAndLog("This function takes no arguments. ");
365 PrintAndLog("Use 'lf config' to set parameters.");
370 PrintAndLog("Usage: lf snoop");
371 PrintAndLog("Options: ");
372 PrintAndLog(" h This help");
373 PrintAndLog("This function takes no arguments. ");
374 PrintAndLog("Use 'lf config' to set parameters.");
378 int usage_lf_config()
380 PrintAndLog("Usage: lf config [H|<divisor>] [b <bps>] [d <decim>] [a 0|1]");
381 PrintAndLog("Options: ");
382 PrintAndLog(" h This help");
383 PrintAndLog(" L Low frequency (125 KHz)");
384 PrintAndLog(" H High frequency (134 KHz)");
385 PrintAndLog(" q <divisor> Manually set divisor. 88-> 134KHz, 95-> 125 Hz");
386 PrintAndLog(" b <bps> Sets resolution of bits per sample. Default (max): 8");
387 PrintAndLog(" d <decim> Sets decimation. A value of N saves only 1 in N samples. Default: 1");
388 PrintAndLog(" a [0|1] Averaging - if set, will average the stored sample value when decimating. Default: 1");
389 PrintAndLog(" t <threshold> Sets trigger threshold. 0 means no threshold");
390 PrintAndLog("Examples:");
391 PrintAndLog(" lf config b 8 L");
392 PrintAndLog(" Samples at 125KHz, 8bps.");
393 PrintAndLog(" lf config H b 4 d 3");
394 PrintAndLog(" Samples at 134KHz, averages three samples into one, stored with ");
395 PrintAndLog(" a resolution of 4 bits per sample.");
396 PrintAndLog(" lf read");
397 PrintAndLog(" Performs a read (active field)");
398 PrintAndLog(" lf snoop");
399 PrintAndLog(" Performs a snoop (no active field)");
403 int CmdLFSetConfig(const char *Cmd
)
406 uint8_t divisor
= 0;//Frequency divisor
407 uint8_t bps
= 0; // Bits per sample
408 uint8_t decimation
= 0; //How many to keep
409 bool averaging
= 1; // Defaults to true
411 int trigger_threshold
=-1;//Means no change
412 uint8_t unsigned_trigg
= 0;
415 while(param_getchar(Cmd
, cmdp
) != 0x00)
417 switch(param_getchar(Cmd
, cmdp
))
420 return usage_lf_config();
430 errors
|= param_getdec(Cmd
,cmdp
+1,&divisor
);
434 errors
|= param_getdec(Cmd
,cmdp
+1,&unsigned_trigg
);
436 if(!errors
) trigger_threshold
= unsigned_trigg
;
439 errors
|= param_getdec(Cmd
,cmdp
+1,&bps
);
443 errors
|= param_getdec(Cmd
,cmdp
+1,&decimation
);
447 averaging
= param_getchar(Cmd
,cmdp
+1) == '1';
451 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
459 errors
= 1;// No args
465 return usage_lf_config();
467 //Bps is limited to 8, so fits in lower half of arg1
468 if(bps
>> 8) bps
= 8;
470 sample_config config
= {
471 decimation
,bps
,averaging
,divisor
,trigger_threshold
473 //Averaging is a flag on high-bit of arg[1]
474 UsbCommand c
= {CMD_SET_LF_SAMPLING_CONFIG
};
475 memcpy(c
.d
.asBytes
,&config
,sizeof(sample_config
));
480 int CmdLFRead(const char *Cmd
)
484 if(param_getchar(Cmd
, cmdp
) == 'h')
486 return usage_lf_read();
488 //And ship it to device
489 UsbCommand c
= {CMD_ACQUIRE_RAW_ADC_SAMPLES_125K
};
491 WaitForResponse(CMD_ACK
,NULL
);
495 int CmdLFSnoop(const char *Cmd
)
498 if(param_getchar(Cmd
, cmdp
) == 'h')
500 return usage_lf_snoop();
503 UsbCommand c
= {CMD_LF_SNOOP_RAW_ADC_SAMPLES
};
505 WaitForResponse(CMD_ACK
,NULL
);
509 static void ChkBitstream(const char *str
)
513 /* convert to bitstream if necessary */
514 for (i
= 0; i
< (int)(GraphTraceLen
/ 2); i
++){
515 if (GraphBuffer
[i
] > 1 || GraphBuffer
[i
] < 0) {
521 //appears to attempt to simulate manchester
522 int CmdLFSim(const char *Cmd
)
527 sscanf(Cmd
, "%i", &gap
);
529 /* convert to bitstream if necessary */
532 //can send 512 bits at a time (1 byte sent per bit...)
533 printf("Sending [%d bytes]", GraphTraceLen
);
534 for (i
= 0; i
< GraphTraceLen
; i
+= USB_CMD_DATA_SIZE
) {
535 UsbCommand c
={CMD_DOWNLOADED_SIM_SAMPLES_125K
, {i
, 0, 0}};
537 for (j
= 0; j
< USB_CMD_DATA_SIZE
; j
++) {
538 c
.d
.asBytes
[j
] = GraphBuffer
[i
+j
];
541 WaitForResponse(CMD_ACK
,NULL
);
546 PrintAndLog("Starting to simulate");
547 UsbCommand c
= {CMD_SIMULATE_TAG_125K
, {GraphTraceLen
, gap
, 0}};
552 int usage_lf_simfsk(void)
555 PrintAndLog("Usage: lf simfsk [c <clock>] [i] [H <fcHigh>] [L <fcLow>] [d <hexdata>]");
556 PrintAndLog("Options: ");
557 PrintAndLog(" h This help");
558 PrintAndLog(" c <clock> Manually set clock - can autodetect if using DemodBuffer");
559 PrintAndLog(" i invert data");
560 PrintAndLog(" H <fcHigh> Manually set the larger Field Clock");
561 PrintAndLog(" L <fcLow> Manually set the smaller Field Clock");
562 //PrintAndLog(" s TBD- -to enable a gap between playback repetitions - default: no gap");
563 PrintAndLog(" d <hexdata> Data to sim as hex - omit to sim from DemodBuffer");
564 PrintAndLog("\n NOTE: if you set one clock manually set them all manually");
568 int usage_lf_simask(void)
571 PrintAndLog("Usage: lf simask [c <clock>] [i] [m|r] [s] [d <raw hex to sim>]");
572 PrintAndLog("Options: ");
573 PrintAndLog(" h This help");
574 PrintAndLog(" c <clock> Manually set clock - can autodetect if using DemodBuffer");
575 PrintAndLog(" i invert data");
576 PrintAndLog(" m sim ask/manchester");
577 PrintAndLog(" r sim ask/raw");
578 PrintAndLog(" s TBD- -to enable a gap between playback repetitions - default: no gap");
579 PrintAndLog(" d <hexdata> Data to sim as hex - omit to sim from DemodBuffer");
583 int usage_lf_simpsk(void)
586 PrintAndLog("Usage: lf simpsk [1|2|3] [c <clock>] [i] [r <carrier>] [d <raw hex to sim>]");
587 PrintAndLog("Options: ");
588 PrintAndLog(" h This help");
589 PrintAndLog(" c <clock> Manually set clock - can autodetect if using DemodBuffer");
590 PrintAndLog(" i invert data");
591 PrintAndLog(" 1 set PSK1 (default)");
592 PrintAndLog(" 2 set PSK2");
593 PrintAndLog(" 3 set PSK3");
594 PrintAndLog(" r <carrier> 2|4|8 are valid carriers: default = 2");
595 PrintAndLog(" d <hexdata> Data to sim as hex - omit to sim from DemodBuffer");
598 // by marshmellow - sim ask data given clock, fcHigh, fcLow, invert
599 // - allow pull data from DemodBuffer
600 int CmdLFfskSim(const char *Cmd
)
602 //might be able to autodetect FC and clock from Graphbuffer if using demod buffer
603 //will need FChigh, FClow, Clock, and bitstream
604 uint8_t fcHigh
=0, fcLow
=0, clk
=0;
607 char hexData
[32] = {0x00}; // store entered hex data
608 uint8_t data
[255] = {0x00};
611 while(param_getchar(Cmd
, cmdp
) != 0x00)
613 switch(param_getchar(Cmd
, cmdp
))
616 return usage_lf_simfsk();
622 errors
|= param_getdec(Cmd
,cmdp
+1,&clk
);
626 errors
|= param_getdec(Cmd
,cmdp
+1,&fcHigh
);
630 errors
|= param_getdec(Cmd
,cmdp
+1,&fcLow
);
638 dataLen
= param_getstr(Cmd
, cmdp
+1, hexData
);
642 dataLen
= hextobinarray((char *)data
, hexData
);
644 if (dataLen
==0) errors
=TRUE
;
645 if (errors
) PrintAndLog ("Error getting hex data");
649 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
655 if(cmdp
== 0 && DemodBufferLen
== 0)
657 errors
= TRUE
;// No args
663 return usage_lf_simfsk();
666 if (dataLen
== 0){ //using DemodBuffer
667 if (clk
==0 || fcHigh
==0 || fcLow
==0){ //manual settings must set them all
668 uint8_t ans
= fskClocks(&fcHigh
, &fcLow
, &clk
, 0);
670 if (!fcHigh
) fcHigh
=10;
676 setDemodBuf(data
, dataLen
, 0);
678 if (clk
== 0) clk
= 50;
679 if (fcHigh
== 0) fcHigh
= 10;
680 if (fcLow
== 0) fcLow
= 8;
683 arg1
= fcHigh
<< 8 | fcLow
;
684 arg2
= invert
<< 8 | clk
;
685 UsbCommand c
= {CMD_FSK_SIM_TAG
, {arg1
, arg2
, DemodBufferLen
}};
686 if (DemodBufferLen
> USB_CMD_DATA_SIZE
) {
687 PrintAndLog("DemodBuffer too long for current implementation - length: %d - max: %d", DemodBufferLen
, USB_CMD_DATA_SIZE
);
689 memcpy(c
.d
.asBytes
, DemodBuffer
, DemodBufferLen
);
694 // by marshmellow - sim ask data given clock, invert, manchester or raw, separator
695 // - allow pull data from DemodBuffer
696 int CmdLFaskSim(const char *Cmd
)
698 //autodetect clock from Graphbuffer if using demod buffer
699 //will need clock, invert, manchester/raw as m or r, separator as s, and bitstream
700 uint8_t manchester
= 1, separator
= 0;
701 //char cmdp = Cmd[0], par3='m', par4=0;
702 uint8_t clk
=0, invert
=0;
704 char hexData
[32] = {0x00};
705 uint8_t data
[255]= {0x00}; // store entered hex data
708 while(param_getchar(Cmd
, cmdp
) != 0x00)
710 switch(param_getchar(Cmd
, cmdp
))
713 return usage_lf_simask();
719 errors
|= param_getdec(Cmd
,cmdp
+1,&clk
);
735 dataLen
= param_getstr(Cmd
, cmdp
+1, hexData
);
739 dataLen
= hextobinarray((char *)data
, hexData
);
741 if (dataLen
==0) errors
=TRUE
;
742 if (errors
) PrintAndLog ("Error getting hex data, datalen: %d",dataLen
);
746 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
752 if(cmdp
== 0 && DemodBufferLen
== 0)
754 errors
= TRUE
;// No args
760 return usage_lf_simask();
762 if (dataLen
== 0){ //using DemodBuffer
763 if (clk
== 0) clk
= GetAskClock("0", false, false);
765 setDemodBuf(data
, dataLen
, 0);
767 if (clk
== 0) clk
= 64;
770 arg1
= clk
<< 8 | manchester
;
771 arg2
= invert
<< 8 | separator
;
772 UsbCommand c
= {CMD_ASK_SIM_TAG
, {arg1
, arg2
, DemodBufferLen
}};
773 if (DemodBufferLen
> USB_CMD_DATA_SIZE
) {
774 PrintAndLog("DemodBuffer too long for current implementation - length: %d - max: %d", DemodBufferLen
, USB_CMD_DATA_SIZE
);
776 PrintAndLog("preparing to sim ask data: %d bits", DemodBufferLen
);
777 memcpy(c
.d
.asBytes
, DemodBuffer
, DemodBufferLen
);
782 // by marshmellow - sim psk data given carrier, clock, invert
783 // - allow pull data from DemodBuffer or parameters
784 int CmdLFpskSim(const char *Cmd
)
786 //might be able to autodetect FC and clock from Graphbuffer if using demod buffer
787 //will need carrier, Clock, and bitstream
788 uint8_t carrier
=0, clk
=0;
791 char hexData
[32] = {0x00}; // store entered hex data
792 uint8_t data
[255] = {0x00};
796 while(param_getchar(Cmd
, cmdp
) != 0x00)
798 switch(param_getchar(Cmd
, cmdp
))
801 return usage_lf_simpsk();
807 errors
|= param_getdec(Cmd
,cmdp
+1,&clk
);
811 errors
|= param_getdec(Cmd
,cmdp
+1,&carrier
);
827 dataLen
= param_getstr(Cmd
, cmdp
+1, hexData
);
831 dataLen
= hextobinarray((char *)data
, hexData
);
833 if (dataLen
==0) errors
=TRUE
;
834 if (errors
) PrintAndLog ("Error getting hex data");
838 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
844 if (cmdp
== 0 && DemodBufferLen
== 0)
846 errors
= TRUE
;// No args
852 return usage_lf_simpsk();
854 if (dataLen
== 0){ //using DemodBuffer
855 if (clk
==0) clk
= GetPskClock(NULL
, FALSE
, FALSE
);
856 if (!carrier
) carrier
= GetPskCarrier(NULL
, FALSE
, FALSE
);
858 setDemodBuf(data
, dataLen
, 0);
860 if (clk
<= 0) clk
= 32;
861 if (carrier
== 0) carrier
= 2;
864 arg1
= clk
<< 8 | carrier
;
866 UsbCommand c
= {CMD_PSK_SIM_TAG
, {arg1
, arg2
, DemodBufferLen
}};
867 if (DemodBufferLen
> USB_CMD_DATA_SIZE
) {
868 PrintAndLog("DemodBuffer too long for current implementation - length: %d - max: %d", DemodBufferLen
, USB_CMD_DATA_SIZE
);
870 memcpy(c
.d
.asBytes
, DemodBuffer
, DemodBufferLen
);
875 int CmdLFSimBidir(const char *Cmd
)
877 // Set ADC to twice the carrier for a slight supersampling
878 // HACK: not implemented in ARMSRC.
879 PrintAndLog("Not implemented yet.");
880 UsbCommand c
= {CMD_LF_SIMULATE_BIDIR
, {47, 384, 0}};
885 /* simulate an LF Manchester encoded tag with specified bitstream, clock rate and inter-id gap */
886 int CmdLFSimManchester(const char *Cmd
)
888 static int clock
, gap
;
889 static char data
[1024], gapstring
[8];
891 sscanf(Cmd
, "%i %s %i", &clock
, &data
[0], &gap
);
895 for (int i
= 0; i
< strlen(data
) ; ++i
)
896 AppendGraph(0, clock
, data
[i
]- '0');
898 CmdManchesterMod("");
900 RepaintGraphWindow();
902 sprintf(&gapstring
[0], "%i", gap
);
908 int CmdVchDemod(const char *Cmd
)
910 // Is this the entire sync pattern, or does this also include some
911 // data bits that happen to be the same everywhere? That would be
913 static const int SyncPattern
[] = {
914 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
915 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
916 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
917 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
918 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
919 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
920 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
921 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
922 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
923 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
926 // So first, we correlate for the sync pattern, and mark that.
927 int bestCorrel
= 0, bestPos
= 0;
929 // It does us no good to find the sync pattern, with fewer than
930 // 2048 samples after it...
931 for (i
= 0; i
< (GraphTraceLen
-2048); i
++) {
934 for (j
= 0; j
< arraylen(SyncPattern
); j
++) {
935 sum
+= GraphBuffer
[i
+j
]*SyncPattern
[j
];
937 if (sum
> bestCorrel
) {
942 PrintAndLog("best sync at %d [metric %d]", bestPos
, bestCorrel
);
950 for (i
= 0; i
< 2048; i
+= 8) {
953 for (j
= 0; j
< 8; j
++) {
954 sum
+= GraphBuffer
[bestPos
+i
+j
];
961 if(abs(sum
) < worst
) {
966 PrintAndLog("bits:");
967 PrintAndLog("%s", bits
);
968 PrintAndLog("worst metric: %d at pos %d", worst
, worstPos
);
970 if (strcmp(Cmd
, "clone")==0) {
973 for(s
= bits
; *s
; s
++) {
975 for(j
= 0; j
< 16; j
++) {
976 GraphBuffer
[GraphTraceLen
++] = (*s
== '1') ? 1 : 0;
979 RepaintGraphWindow();
985 int CmdLFfind(const char *Cmd
)
988 char cmdp
= param_getchar(Cmd
, 0);
989 char testRaw
= param_getchar(Cmd
, 1);
990 if (strlen(Cmd
) > 2 || cmdp
== 'h' || cmdp
== 'H') {
991 PrintAndLog("Usage: lf search <0|1> [u]");
992 PrintAndLog(" <use data from Graphbuffer> , if not set, try reading data from tag.");
993 PrintAndLog(" [Search for Unknown tags] , if not set, reads only known tags.");
995 PrintAndLog(" sample: lf search = try reading data from tag & search for known tags");
996 PrintAndLog(" : lf search 1 = use data from GraphBuffer & search for known tags");
997 PrintAndLog(" : lf search u = try reading data from tag & search for known and unknown tags");
998 PrintAndLog(" : lf search 1 u = use data from GraphBuffer & search for known and unknown tags");
1003 if (!offline
&& (cmdp
!= '1')){
1005 ans
=CmdSamples("20000");
1006 } else if (GraphTraceLen
< 1000) {
1007 PrintAndLog("Data in Graphbuffer was too small.");
1010 if (cmdp
== 'u' || cmdp
== 'U') testRaw
= 'u';
1011 PrintAndLog("NOTE: some demods output possible binary\n if it finds something that looks like a tag");
1012 PrintAndLog("False Positives ARE possible\n");
1013 PrintAndLog("\nChecking for known tags:\n");
1014 ans
=CmdFSKdemodIO("");
1016 PrintAndLog("\nValid IO Prox ID Found!");
1019 ans
=CmdFSKdemodPyramid("");
1021 PrintAndLog("\nValid Pyramid ID Found!");
1024 ans
=CmdFSKdemodParadox("");
1026 PrintAndLog("\nValid Paradox ID Found!");
1029 ans
=CmdFSKdemodAWID("");
1031 PrintAndLog("\nValid AWID ID Found!");
1034 ans
=CmdFSKdemodHID("");
1036 PrintAndLog("\nValid HID Prox ID Found!");
1039 //add psk and indala
1040 ans
=CmdIndalaDecode("");
1042 PrintAndLog("\nValid Indala ID Found!");
1045 ans
=CmdAskEM410xDemod("");
1047 PrintAndLog("\nValid EM410x ID Found!");
1050 PrintAndLog("\nNo Known Tags Found!\n");
1051 if (testRaw
=='u' || testRaw
=='U'){
1052 //test unknown tag formats (raw mode)
1053 PrintAndLog("\nChecking for Unknown tags:\n");
1054 ans
=CmdDetectClockRate("f");
1055 if (ans
!= 0){ //fsk
1056 ans
=CmdFSKrawdemod("");
1058 PrintAndLog("\nUnknown FSK Modulated Tag Found!");
1062 ans
=Cmdaskmandemod("");
1064 PrintAndLog("\nUnknown ASK Modulated and Manchester encoded Tag Found!");
1067 ans
=CmdPSK1rawDemod("");
1069 PrintAndLog("Possible unknown PSK1 Modulated Tag Found above!\n\nCould also be PSK2 - try 'data psk2rawdemod'");
1070 PrintAndLog("\nCould also be PSK3 - [currently not supported]");
1071 PrintAndLog("\nCould also be NRZ - try 'data nrzrawdemod");
1074 PrintAndLog("\nNo Data Found!\n");
1079 static command_t CommandTable
[] =
1081 {"help", CmdHelp
, 1, "This help"},
1082 {"cmdread", CmdLFCommandRead
, 0, "<off period> <'0' period> <'1' period> <command> ['h'] -- Modulate LF reader field to send command before read (all periods in microseconds) (option 'h' for 134)"},
1083 {"em4x", CmdLFEM4X
, 1, "{ EM4X RFIDs... }"},
1084 {"config", CmdLFSetConfig
, 0, "Set config for LF sampling, bit/sample, decimation, frequency"},
1085 {"flexdemod", CmdFlexdemod
, 1, "Demodulate samples for FlexPass"},
1086 {"hid", CmdLFHID
, 1, "{ HID RFIDs... }"},
1087 {"io", CmdLFIO
, 1, "{ ioProx tags... }"},
1088 {"indalademod", CmdIndalaDemod
, 1, "['224'] -- Demodulate samples for Indala 64 bit UID (option '224' for 224 bit)"},
1089 {"indalaclone", CmdIndalaClone
, 0, "<UID> ['l']-- Clone Indala to T55x7 (tag must be in antenna)(UID in HEX)(option 'l' for 224 UID"},
1090 {"read", CmdLFRead
, 0, "Read 125/134 kHz LF ID-only tag. Do 'lf read h' for help"},
1091 {"search", CmdLFfind
, 1, "[offline] ['u'] Read and Search for valid known tag (in offline mode it you can load first then search) - 'u' to search for unknown tags"},
1092 {"sim", CmdLFSim
, 0, "[GAP] -- Simulate LF tag from buffer with optional GAP (in microseconds)"},
1093 {"simask", CmdLFaskSim
, 0, "[clock] [invert <1|0>] [manchester/raw <'m'|'r'>] [trs separator 's'] [d <hexdata>] -- Simulate LF ASK tag from demodbuffer or input"},
1094 {"simfsk", CmdLFfskSim
, 0, "[c <clock>] [i] [H <fcHigh>] [L <fcLow>] [d <hexdata>] -- Simulate LF FSK tag from demodbuffer or input"},
1095 {"simpsk", CmdLFpskSim
, 0, "[1|2|3] [c <clock>] [i] [r <carrier>] [d <raw hex to sim>] -- Simulate LF PSK tag from demodbuffer or input"},
1096 {"simbidir", CmdLFSimBidir
, 0, "Simulate LF tag (with bidirectional data transmission between reader and tag)"},
1097 {"simman", CmdLFSimManchester
, 0, "<Clock> <Bitstream> [GAP] Simulate arbitrary Manchester LF tag"},
1098 {"snoop", CmdLFSnoop
, 0, "['l'|'h'|<divisor>] [trigger threshold]-- Snoop LF (l:125khz, h:134khz)"},
1099 {"ti", CmdLFTI
, 1, "{ TI RFIDs... }"},
1100 {"hitag", CmdLFHitag
, 1, "{ Hitag tags and transponders... }"},
1101 {"vchdemod", CmdVchDemod
, 1, "['clone'] -- Demodulate samples for VeriChip"},
1102 {"t55xx", CmdLFT55XX
, 1, "{ T55xx RFIDs... }"},
1103 {"pcf7931", CmdLFPCF7931
, 1, "{PCF7931 RFIDs...}"},
1104 {NULL
, NULL
, 0, NULL
}
1107 int CmdLF(const char *Cmd
)
1109 CmdsParse(CommandTable
, Cmd
);
1113 int CmdHelp(const char *Cmd
)
1115 CmdsHelp(CommandTable
);