1 //-----------------------------------------------------------------------------
3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
4 // at your option, any later version. See the LICENSE.txt file for the text of
6 //-----------------------------------------------------------------------------
7 // Low frequency T55xx commands
8 //-----------------------------------------------------------------------------
14 #include "proxmark3.h"
18 #include "cmdparser.h"
21 #include "cmdlft55xx.h"
25 #include "../common/crc.h"
26 #include "../common/iso14443crc.h"
29 #define CONFIGURATION_BLOCK 0x00
30 #define TRACE_BLOCK 0x01
32 // Default configuration
33 t55xx_conf_block_t config
= { .modulation
= DEMOD_ASK
, .inverted
= FALSE
, .offset
= 0x00, .block0
= 0x00};
35 int usage_t55xx_config(){
36 PrintAndLog("Usage: lf t55xx config [d <demodulation>] [i 1] [o <offset>]");
37 PrintAndLog("Options: ");
38 PrintAndLog(" h This help");
39 PrintAndLog(" b <8|16|32|40|50|64|100|128> Set bitrate");
40 PrintAndLog(" d <FSK|FSK1|FSK1a|FSK2|FSK2a|ASK|PSK1|PSK2|NZ|BI|BIa> Set demodulation FSK / ASK / PSK / NZ / Biphase / Biphase A");
41 PrintAndLog(" i [1] Invert data signal, defaults to normal");
42 PrintAndLog(" o [offset] Set offset, where data should start decode in bitstream");
44 PrintAndLog("Examples:");
45 PrintAndLog(" lf t55xx config d FSK - FSK demodulation");
46 PrintAndLog(" lf t55xx config d FSK i 1 - FSK demodulation, inverse data");
47 PrintAndLog(" lf t55xx config d FSK i 1 o 3 - FSK demodulation, inverse data, offset=3,start from position 3 to decode data");
51 int usage_t55xx_read(){
52 PrintAndLog("Usage: lf t55xx read <block> <password>");
53 PrintAndLog(" <block>, block number to read. Between 0-7");
54 PrintAndLog(" <password>, OPTIONAL password (8 hex characters)");
56 PrintAndLog("Examples:");
57 PrintAndLog(" lf t55xx read 0 - read data from block 0");
58 PrintAndLog(" lf t55xx read 0 feedbeef - read data from block 0 password feedbeef");
62 int usage_t55xx_write(){
63 PrintAndLog("Usage: lf t55xx wr <block> <data> [password]");
64 PrintAndLog(" <block>, block number to read. Between 0-7");
65 PrintAndLog(" <data>, 4 bytes of data to write (8 hex characters)");
66 PrintAndLog(" [password], OPTIONAL password 4bytes (8 hex characters)");
68 PrintAndLog("Examples:");
69 PrintAndLog(" lf t55xx wd 3 11223344 - write 11223344 to block 3");
70 PrintAndLog(" lf t55xx wd 3 11223344 feedbeef - write 11223344 to block 3 password feedbeef");
74 int usage_t55xx_trace() {
75 PrintAndLog("Usage: lf t55xx trace [1]");
76 PrintAndLog(" [graph buffer data], if set, use Graphbuffer otherwise read data from tag.");
78 PrintAndLog("Examples:");
79 PrintAndLog(" lf t55xx trace");
80 PrintAndLog(" lf t55xx trace 1");
84 int usage_t55xx_info() {
85 PrintAndLog("Usage: lf t55xx info [1]");
86 PrintAndLog(" [graph buffer data], if set, use Graphbuffer otherwise read data from tag.");
88 PrintAndLog("Examples:");
89 PrintAndLog(" lf t55xx info");
90 PrintAndLog(" lf t55xx info 1");
94 int usage_t55xx_dump(){
95 PrintAndLog("Usage: lf t55xx dump <password>");
96 PrintAndLog(" <password>, OPTIONAL password 4bytes (8 hex symbols)");
98 PrintAndLog("Examples:");
99 PrintAndLog(" lf t55xx dump");
100 PrintAndLog(" lf t55xx dump feedbeef");
104 int usage_t55xx_detect(){
105 PrintAndLog("Usage: lf t55xx detect");
107 PrintAndLog("Examples:");
108 PrintAndLog(" lf t55xx detect");
109 PrintAndLog(" lf t55xx detect 1");
114 static int CmdHelp(const char *Cmd
);
116 int CmdT55xxSetConfig(const char *Cmd
) {
121 char modulation
[5] = {0x00};
124 uint8_t rates
[9] = {8,16,32,40,50,64,100,128,0};
125 while(param_getchar(Cmd
, cmdp
) != 0x00 && !errors
)
127 tmp
= param_getchar(Cmd
, cmdp
);
132 return usage_t55xx_config();
134 errors
|= param_getdec(Cmd
, cmdp
+1, &bitRate
);
138 if (rates
[i
]==bitRate
) {
143 if (i
==9) errors
= TRUE
;
148 param_getstr(Cmd
, cmdp
+1, modulation
);
151 if ( strcmp(modulation
, "FSK" ) == 0)
152 config
.modulation
= DEMOD_FSK
;
153 else if ( strcmp(modulation
, "FSK1" ) == 0)
154 config
.modulation
= DEMOD_FSK1
;
155 else if ( strcmp(modulation
, "FSK1a" ) == 0)
156 config
.modulation
= DEMOD_FSK1a
;
157 else if ( strcmp(modulation
, "FSK2" ) == 0)
158 config
.modulation
= DEMOD_FSK2
;
159 else if ( strcmp(modulation
, "FSK2a" ) == 0)
160 config
.modulation
= DEMOD_FSK2a
;
161 else if ( strcmp(modulation
, "ASK" ) == 0)
162 config
.modulation
= DEMOD_ASK
;
163 else if ( strcmp(modulation
, "NRZ" ) == 0)
164 config
.modulation
= DEMOD_NRZ
;
165 else if ( strcmp(modulation
, "PSK1" ) == 0)
166 config
.modulation
= DEMOD_PSK1
;
167 else if ( strcmp(modulation
, "PSK2" ) == 0)
168 config
.modulation
= DEMOD_PSK2
;
169 else if ( strcmp(modulation
, "PSK3" ) == 0)
170 config
.modulation
= DEMOD_PSK3
;
171 else if ( strcmp(modulation
, "BIa" ) == 0)
172 config
.modulation
= DEMOD_BIa
;
173 else if ( strcmp(modulation
, "BI" ) == 0)
174 config
.modulation
= DEMOD_BI
;
176 PrintAndLog("Unknown modulation '%s'", modulation
);
181 config
.inverted
= param_getchar(Cmd
,cmdp
+1) == '1';
185 errors
|= param_getdec(Cmd
, cmdp
+1, &offset
);
187 config
.offset
= offset
;
191 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd
, cmdp
));
199 printConfiguration( config
);
204 return usage_t55xx_config();
207 printConfiguration ( config
);
211 int CmdT55xxReadBlock(const char *Cmd
) {
213 int password
= 0xFFFFFFFF; //default to blank Block 7
215 char cmdp
= param_getchar(Cmd
, 0);
216 if (cmdp
== 'h' || cmdp
== 'H')
217 return usage_t55xx_read();
219 int res
= sscanf(Cmd
, "%d %x", &block
, &password
);
221 if ( res
< 1 || res
> 2 )
222 return usage_t55xx_read();
225 if ((block
< 0) | (block
> 7)) {
226 PrintAndLog("Block must be between 0 and 7");
230 UsbCommand c
= {CMD_T55XX_READ_BLOCK
, {0, block
, 0}};
231 c
.d
.asBytes
[0] = 0x0;
236 c
.d
.asBytes
[0] = 0x1;
240 if ( !WaitForResponseTimeout(CMD_ACK
,NULL
,2500) ) {
241 PrintAndLog("command execution time out");
246 GetFromBigBuf(got
,sizeof(got
),0);
247 WaitForResponse(CMD_ACK
,NULL
);
248 setGraphBuf(got
, 12000);
250 if (!DecodeT55xxBlock()) return 3;
252 sprintf(blk
,"%d", block
);
253 printT55xxBlock(blk
);
257 bool DecodeT55xxBlock(){
259 char buf
[9] = {0x00};
262 uint8_t bitRate
[8] = {8,16,32,40,50,64,100,128};
264 DemodBufferLen
= 0x00;
266 switch( config
.modulation
){
268 sprintf(cmdStr
,"%d", bitRate
[config
.bitrate
]/2 );
270 sprintf(cmdStr
,"%d %d", bitRate
[config
.bitrate
], config
.inverted
);
271 ans
= FSKrawDemod(cmdStr
, FALSE
);
275 sprintf(cmdStr
,"%d", bitRate
[config
.bitrate
]/2 );
277 sprintf(cmdStr
,"%d %d 8 5", bitRate
[config
.bitrate
], config
.inverted
);
278 ans
= FSKrawDemod(cmdStr
, FALSE
);
282 sprintf(cmdStr
,"%d", bitRate
[config
.bitrate
]/2 );
284 sprintf(cmdStr
,"%d %d 10 8", bitRate
[config
.bitrate
], config
.inverted
);
285 ans
= FSKrawDemod(cmdStr
, FALSE
);
288 sprintf(cmdStr
,"%d %d 1", bitRate
[config
.bitrate
], config
.inverted
);
289 ans
= ASKmanDemod(cmdStr
, FALSE
, FALSE
);
292 sprintf(cmdStr
,"%d %d 1", bitRate
[config
.bitrate
], config
.inverted
);
293 ans
= PSKDemod(cmdStr
, FALSE
);
296 sprintf(cmdStr
,"%d %d 1", bitRate
[config
.bitrate
], config
.inverted
);
297 ans
= PSKDemod(cmdStr
, FALSE
);
298 psk1TOpsk2(DemodBuffer
, DemodBufferLen
);
301 sprintf(cmdStr
,"%d %d 1", bitRate
[config
.bitrate
], config
.inverted
);
302 ans
= PSKDemod(cmdStr
, FALSE
);
303 psk1TOpsk2(DemodBuffer
, DemodBufferLen
);
306 sprintf(cmdStr
,"%d %d 1", bitRate
[config
.bitrate
], config
.inverted
);
307 ans
= NRZrawDemod(cmdStr
, FALSE
);
311 sprintf(cmdStr
,"0 %d %d 1", bitRate
[config
.bitrate
], config
.inverted
);
312 ans
= ASKbiphaseDemod(cmdStr
, FALSE
);
320 int CmdT55xxDetect(const char *Cmd
){
322 char cmdp
= param_getchar(Cmd
, 0);
323 if (strlen(Cmd
) > 1 || cmdp
== 'h' || cmdp
== 'H')
324 return usage_t55xx_detect();
327 AquireData( CONFIGURATION_BLOCK
);
329 if ( !tryDetectModulation() )
330 PrintAndLog("Could not detect modulation automatically. Try setting it manually with \'lf t55xx config\'");
335 // detect configuration?
336 bool tryDetectModulation(){
337 char cmdStr
[8] = {0};
339 t55xx_conf_block_t tests
[15];
341 if (GetFskClock("", FALSE
, FALSE
)){
342 uint8_t fc1
= 0, fc2
= 0, clk
=0;
343 fskClocks(&fc1
, &fc2
, &clk
, FALSE
);
344 sprintf(cmdStr
,"%d", clk
/2);
346 if ( FSKrawDemod("0 0", FALSE
) && test(DEMOD_FSK
, &tests
[hits
].offset
)){
347 tests
[hits
].modulation
= DEMOD_FSK
;
348 if (fc1
==8 && fc2
== 5)
349 tests
[hits
].modulation
= DEMOD_FSK1a
;
350 else if (fc1
==10 && fc2
== 8)
351 tests
[hits
].modulation
= DEMOD_FSK2
;
353 tests
[hits
].inverted
= FALSE
;
354 tests
[hits
].block0
= PackBits(tests
[hits
].offset
, 32, DemodBuffer
);
357 if ( FSKrawDemod("0 1", FALSE
) && test(DEMOD_FSK
, &tests
[hits
].offset
)) {
358 tests
[hits
].modulation
= DEMOD_FSK
;
359 if (fc1
==8 && fc2
== 5)
360 tests
[hits
].modulation
= DEMOD_FSK1
;
361 else if (fc1
==10 && fc2
== 8)
362 tests
[hits
].modulation
= DEMOD_FSK2a
;
364 tests
[hits
].inverted
= TRUE
;
365 tests
[hits
].block0
= PackBits(tests
[hits
].offset
, 32, DemodBuffer
);
369 if ( ASKmanDemod("0 0 1", FALSE
, FALSE
) && test(DEMOD_ASK
, &tests
[hits
].offset
)) {
370 tests
[hits
].modulation
= DEMOD_ASK
;
371 tests
[hits
].inverted
= FALSE
;
372 tests
[hits
].block0
= PackBits(tests
[hits
].offset
, 32, DemodBuffer
);
376 if ( ASKmanDemod("0 1 1", FALSE
, FALSE
) && test(DEMOD_ASK
, &tests
[hits
].offset
)) {
377 tests
[hits
].modulation
= DEMOD_ASK
;
378 tests
[hits
].inverted
= TRUE
;
379 tests
[hits
].block0
= PackBits(tests
[hits
].offset
, 32, DemodBuffer
);
383 if ( NRZrawDemod("0 0 1", FALSE
) && test(DEMOD_NRZ
, &tests
[hits
].offset
)) {
384 tests
[hits
].modulation
= DEMOD_NRZ
;
385 tests
[hits
].inverted
= FALSE
;
386 tests
[hits
].block0
= PackBits(tests
[hits
].offset
, 32, DemodBuffer
);
390 if ( NRZrawDemod("0 1 1", FALSE
) && test(DEMOD_NRZ
, &tests
[hits
].offset
)) {
391 tests
[hits
].modulation
= DEMOD_NRZ
;
392 tests
[hits
].inverted
= TRUE
;
393 tests
[hits
].block0
= PackBits(tests
[hits
].offset
, 32, DemodBuffer
);
397 if ( PSKDemod("0 0 1", FALSE
) && test(DEMOD_PSK1
, &tests
[hits
].offset
)) {
398 tests
[hits
].modulation
= DEMOD_PSK1
;
399 tests
[hits
].inverted
= FALSE
;
400 tests
[hits
].block0
= PackBits(tests
[hits
].offset
, 32, DemodBuffer
);
404 if ( PSKDemod("0 1 1", FALSE
) && test(DEMOD_PSK1
, &tests
[hits
].offset
)) {
405 tests
[hits
].modulation
= DEMOD_PSK1
;
406 tests
[hits
].inverted
= TRUE
;
407 tests
[hits
].block0
= PackBits(tests
[hits
].offset
, 32, DemodBuffer
);
411 // PSK2 - needs a call to psk1TOpsk2.
412 if ( PSKDemod("0 0 1", FALSE
)) {
413 psk1TOpsk2(DemodBuffer
, DemodBufferLen
);
414 if (test(DEMOD_PSK2
, &tests
[hits
].offset
)){
415 tests
[hits
].modulation
= DEMOD_PSK2
;
416 tests
[hits
].inverted
= FALSE
;
417 tests
[hits
].block0
= PackBits(tests
[hits
].offset
, 32, DemodBuffer
);
420 } // inverse waves does not affect this demod
422 // PSK3 - needs a call to psk1TOpsk2.
423 if ( PSKDemod("0 0 1", FALSE
)) {
424 psk1TOpsk2(DemodBuffer
, DemodBufferLen
);
425 if (test(DEMOD_PSK3
, &tests
[hits
].offset
)){
426 tests
[hits
].modulation
= DEMOD_PSK3
;
427 tests
[hits
].inverted
= FALSE
;
428 tests
[hits
].block0
= PackBits(tests
[hits
].offset
, 32, DemodBuffer
);
431 } // inverse waves does not affect this demod
433 if ( ASKbiphaseDemod("0 0 0 1", FALSE
) && test(DEMOD_BI
, &tests
[hits
].offset
) ) {
434 tests
[hits
].modulation
= DEMOD_BI
;
435 tests
[hits
].inverted
= FALSE
;
436 tests
[hits
].block0
= PackBits(tests
[hits
].offset
, 32, DemodBuffer
);
439 if ( ASKbiphaseDemod("0 0 1 1", FALSE
) && test(DEMOD_BIa
, &tests
[hits
].offset
) ) {
440 tests
[hits
].modulation
= DEMOD_BIa
;
441 tests
[hits
].inverted
= TRUE
;
442 tests
[hits
].block0
= PackBits(tests
[hits
].offset
, 32, DemodBuffer
);
447 config
.modulation
= tests
[0].modulation
;
448 config
.inverted
= tests
[0].inverted
;
449 config
.offset
= tests
[0].offset
;
450 config
.block0
= tests
[0].block0
;
451 printConfiguration( config
);
456 PrintAndLog("Found [%d] possible matches for modulation.",hits
);
457 for(int i
=0; i
<hits
; ++i
){
458 PrintAndLog("--[%d]---------------", i
+1);
459 printConfiguration( tests
[i
] );
465 bool testModulation(uint8_t mode
, uint8_t modread
){
468 if (modread
> 3 && modread
< 8) return TRUE
;
471 if (modread
== DEMOD_ASK
) return TRUE
;
474 if (modread
== DEMOD_PSK1
) return TRUE
;
477 if (modread
== DEMOD_PSK2
) return TRUE
;
480 if (modread
== DEMOD_PSK3
) return TRUE
;
483 if (modread
== DEMOD_NRZ
) return TRUE
;
486 if (modread
== DEMOD_BI
) return TRUE
;
489 if (modread
== DEMOD_BIa
) return TRUE
;
497 bool testBitRate(uint8_t readRate
, uint8_t mod
){
498 uint8_t expected
[8] = {8, 16, 32, 40, 50, 64, 100, 128};
502 detRate
= GetFskClock("",FALSE
, FALSE
);
503 if (expected
[readRate
] == detRate
) {
504 config
.bitrate
= readRate
;
509 detRate
= GetFskClock("",FALSE
, FALSE
);
510 if (expected
[readRate
] == detRate
) {
511 config
.bitrate
= readRate
;
516 detRate
= GetFskClock("",FALSE
, FALSE
);
517 if (expected
[readRate
] == detRate
) {
518 config
.bitrate
= readRate
;
523 detRate
= GetFskClock("",FALSE
, FALSE
);
524 if (expected
[readRate
] == detRate
) {
525 config
.bitrate
= readRate
;
530 detRate
= GetFskClock("",FALSE
, FALSE
);
531 if (expected
[readRate
] == detRate
) {
532 config
.bitrate
= readRate
;
537 detRate
= GetAskClock("",FALSE
, FALSE
);
538 if (expected
[readRate
] == detRate
) {
539 config
.bitrate
= readRate
;
544 detRate
= GetPskClock("",FALSE
, FALSE
);
545 if (expected
[readRate
] == detRate
) {
546 config
.bitrate
= readRate
;
551 detRate
= GetPskClock("",FALSE
, FALSE
);
552 if (expected
[readRate
] == detRate
) {
553 config
.bitrate
= readRate
;
558 detRate
= GetPskClock("",FALSE
, FALSE
);
559 if (expected
[readRate
] == detRate
) {
560 config
.bitrate
= readRate
;
565 detRate
= GetNrzClock("",FALSE
, FALSE
);
566 if (expected
[readRate
] == detRate
) {
567 config
.bitrate
= readRate
;
573 detRate
= GetAskClock("",FALSE
, FALSE
);
574 if (expected
[readRate
] == detRate
) {
575 config
.bitrate
= readRate
;
585 bool test(uint8_t mode
, uint8_t *offset
){
587 if ( !DemodBufferLen
) return FALSE
;
589 for (uint8_t idx
= 0; idx
< 64; idx
++){
591 if ( PackBits(si
, 32, DemodBuffer
) == 0x00 ) continue; // configuration block with only zeros is impossible.
593 uint8_t safer
= PackBits(si
, 4, DemodBuffer
); si
+= 4; //master key
594 uint8_t resv
= PackBits(si
, 4, DemodBuffer
); si
+= 4; //was 7 & +=7+3 //should be only 4 bits if extended mode
595 // 2nibble must be zeroed.
596 // moved test to here, since this gets most faults first.
597 if ( resv
> 0x00) continue;
599 uint8_t xtRate
= PackBits(si
, 3, DemodBuffer
); si
+= 3; //new
600 uint8_t bitRate
= PackBits(si
, 3, DemodBuffer
); si
+= 3; //new could check bit rate
601 uint8_t extend
= PackBits(si
, 1, DemodBuffer
); si
+= 1; //bit 15 extended mode
602 uint8_t modread
= PackBits(si
, 5, DemodBuffer
); si
+= 5+2+1; //new
603 //uint8_t pskcr = PackBits(si, 2, DemodBuffer); si += 2+1; //new could check psk cr
604 uint8_t nml01
= PackBits(si
, 1, DemodBuffer
); si
+= 1+5; //bit 24 , 30, 31 could be tested for 0 if not extended mode
605 uint8_t nml02
= PackBits(si
, 2, DemodBuffer
); si
+= 2;
608 bool extMode
=( (safer
== 0x6 || safer
== 0x9) && extend
) ? TRUE
: FALSE
;
611 if (nml01
|| nml02
|| xtRate
) continue;
614 if (!testModulation(mode
, modread
)) continue;
617 if (!testBitRate(bitRate
, mode
)) continue;
623 void printT55xxBlock(const char *blockNum
){
625 uint8_t i
= config
.offset
;
626 uint8_t endpos
= 32 + i
;
627 uint32_t blockData
= 0;
628 uint8_t bits
[64] = {0x00};
630 if ( !DemodBufferLen
) return;
632 if ( endpos
> DemodBufferLen
){
633 PrintAndLog("The configured offset %d is too big. Possible offset: %d)", i
, DemodBufferLen
-32);
637 for (; i
< endpos
; ++i
)
638 bits
[i
- config
.offset
]=DemodBuffer
[i
];
640 blockData
= PackBits(0, 32, bits
);
641 PrintAndLog("[%s] 0x%08X %s", blockNum
, blockData
, sprint_bin(bits
,32));
644 int special(const char *Cmd
) {
645 uint32_t blockData
= 0;
646 uint8_t bits
[32] = {0x00};
648 PrintAndLog("[OFFSET] [DATA] [BINARY]");
649 PrintAndLog("----------------------------------------------------");
653 for (i
= 0; i
< 32; ++i
)
654 bits
[i
]=DemodBuffer
[j
+i
];
656 blockData
= PackBits(0, 32, bits
);
658 PrintAndLog("[%02d] 0x%08X %s",j
, blockData
, sprint_bin(bits
,32));
663 void printConfiguration( t55xx_conf_block_t b
){
664 PrintAndLog("Modulation : %s", GetSelectedModulationStr(b
.modulation
) );
665 PrintAndLog("Bit Rate : %s", GetBitRateStr(b
.bitrate
) );
666 PrintAndLog("Inverted : %s", (b
.inverted
) ? "Yes" : "No" );
667 PrintAndLog("Offset : %d", b
.offset
);
668 PrintAndLog("Block0 : 0x%08X", b
.block0
);
672 int CmdT55xxWriteBlock(const char *Cmd
)
674 int block
= 8; //default to invalid block
675 int data
= 0xFFFFFFFF; //default to blank Block
676 int password
= 0xFFFFFFFF; //default to blank Block 7
678 char cmdp
= param_getchar(Cmd
, 0);
679 if (cmdp
== 'h' || cmdp
== 'H') {
684 int res
= sscanf(Cmd
, "%d %x %x",&block
, &data
, &password
);
686 if ( res
< 2 || res
> 3) {
692 PrintAndLog("Block number must be between 0 and 7");
696 UsbCommand c
= {CMD_T55XX_WRITE_BLOCK
, {data
, block
, 0}};
697 c
.d
.asBytes
[0] = 0x0;
699 PrintAndLog("Writing to block: %d data : 0x%08X", block
, data
);
704 c
.d
.asBytes
[0] = 0x1;
705 PrintAndLog("pwd : 0x%08X", password
);
711 int CmdT55xxReadTrace(const char *Cmd
)
713 char cmdp
= param_getchar(Cmd
, 0);
715 if (strlen(Cmd
) > 1 || cmdp
== 'h' || cmdp
== 'H')
716 return usage_t55xx_trace();
719 AquireData( TRACE_BLOCK
);
721 if (!DecodeT55xxBlock()) return 1;
723 if ( !DemodBufferLen
) return 1;
725 RepaintGraphWindow();
727 if (config
.offset
> 5)
729 uint8_t si
= config
.offset
+repeat
;
730 uint32_t bl0
= PackBits(si
, 32, DemodBuffer
);
731 uint32_t bl1
= PackBits(si
+32, 32, DemodBuffer
);
732 // uint32_t bl2 = PackBits(si+64, 32, DemodBuffer);
734 uint32_t acl
= PackBits(si
, 8, DemodBuffer
); si
+= 8;
735 uint32_t mfc
= PackBits(si
, 8, DemodBuffer
); si
+= 8;
736 uint32_t cid
= PackBits(si
, 5, DemodBuffer
); si
+= 5;
737 uint32_t icr
= PackBits(si
, 3, DemodBuffer
); si
+= 3;
738 uint32_t year
= PackBits(si
, 4, DemodBuffer
); si
+= 4;
739 uint32_t quarter
= PackBits(si
, 2, DemodBuffer
); si
+= 2;
740 uint32_t lotid
= PackBits(si
, 14, DemodBuffer
); si
+= 14;
741 uint32_t wafer
= PackBits(si
, 5, DemodBuffer
); si
+= 5;
742 uint32_t dw
= PackBits(si
, 15, DemodBuffer
);
745 time_t t
= time(NULL
);
746 struct tm tm
= *localtime(&t
);
747 if ( year
> tm
.tm_year
-110)
753 PrintAndLog("The modulation is most likely wrong since the ACL is not 0xE0. ");
757 PrintAndLog("-- T55xx Trace Information ----------------------------------");
758 PrintAndLog("-------------------------------------------------------------");
759 PrintAndLog(" ACL Allocation class (ISO/IEC 15963-1) : 0x%02X (%d)", acl
, acl
);
760 PrintAndLog(" MFC Manufacturer ID (ISO/IEC 7816-6) : 0x%02X (%d) - %s", mfc
, mfc
, getTagInfo(mfc
));
761 PrintAndLog(" CID : 0x%02X (%d) - %s", cid
, cid
, GetModelStrFromCID(cid
));
762 PrintAndLog(" ICR IC Revision : %d",icr
);
763 PrintAndLog(" Manufactured");
764 PrintAndLog(" Year/Quarter : %d/%d",year
, quarter
);
765 PrintAndLog(" Lot ID : %d", lotid
);
766 PrintAndLog(" Wafer number : %d", wafer
);
767 PrintAndLog(" Die Number : %d", dw
);
768 PrintAndLog("-------------------------------------------------------------");
769 PrintAndLog(" Raw Data - Page 1");
770 PrintAndLog(" Block 0 : 0x%08X %s", bl0
, sprint_bin(DemodBuffer
+config
.offset
+repeat
,32) );
771 PrintAndLog(" Block 1 : 0x%08X %s", bl1
, sprint_bin(DemodBuffer
+config
.offset
+repeat
+32,32) );
772 //PrintAndLog(" Block 2 : 0x%08X %s", bl2, sprint_bin(DemodBuffer+config.offset+repeat+64,32) );
773 PrintAndLog("-------------------------------------------------------------");
779 1-8 ACL Allocation class (ISO/IEC 15963-1) 0xE0
780 9-16 MFC Manufacturer ID (ISO/IEC 7816-6) 0x15 Atmel Corporation
781 17-21 CID 0x1 = Atmel ATA5577M1 0x2 = Atmel ATA5577M2
782 22-24 ICR IC revision
783 25-28 YEAR (BCD encoded) 9 (= 2009)
784 29-30 QUARTER 1,2,3,4
790 18-32 DW, die number sequential
796 int CmdT55xxInfo(const char *Cmd
){
798 Page 0 Block 0 Configuration data.
802 char cmdp
= param_getchar(Cmd
, 0);
804 if (strlen(Cmd
) > 1 || cmdp
== 'h' || cmdp
== 'H')
805 return usage_t55xx_info();
808 AquireData( CONFIGURATION_BLOCK
);
810 if (!DecodeT55xxBlock()) return 1;
812 if ( !DemodBufferLen
) return 1;
814 uint8_t si
= config
.offset
;
815 uint32_t bl0
= PackBits(si
, 32, DemodBuffer
);
817 uint32_t safer
= PackBits(si
, 4, DemodBuffer
); si
+= 4;
818 uint32_t resv
= PackBits(si
, 7, DemodBuffer
); si
+= 7;
819 uint32_t dbr
= PackBits(si
, 3, DemodBuffer
); si
+= 3;
820 uint32_t extend
= PackBits(si
, 1, DemodBuffer
); si
+= 1;
821 uint32_t datamod
= PackBits(si
, 5, DemodBuffer
); si
+= 5;
822 uint32_t pskcf
= PackBits(si
, 2, DemodBuffer
); si
+= 2;
823 uint32_t aor
= PackBits(si
, 1, DemodBuffer
); si
+= 1;
824 uint32_t otp
= PackBits(si
, 1, DemodBuffer
); si
+= 1;
825 uint32_t maxblk
= PackBits(si
, 3, DemodBuffer
); si
+= 3;
826 uint32_t pwd
= PackBits(si
, 1, DemodBuffer
); si
+= 1;
827 uint32_t sst
= PackBits(si
, 1, DemodBuffer
); si
+= 1;
828 uint32_t fw
= PackBits(si
, 1, DemodBuffer
); si
+= 1;
829 uint32_t inv
= PackBits(si
, 1, DemodBuffer
); si
+= 1;
830 uint32_t por
= PackBits(si
, 1, DemodBuffer
); si
+= 1;
833 PrintAndLog("-- T55xx Configuration & Tag Information --------------------");
834 PrintAndLog("-------------------------------------------------------------");
835 PrintAndLog(" Safer key : %s", GetSaferStr(safer
));
836 PrintAndLog(" reserved : %d", resv
);
837 PrintAndLog(" Data bit rate : %s", GetBitRateStr(dbr
));
838 PrintAndLog(" eXtended mode : %s", (extend
) ? "Yes - Warning":"No");
839 PrintAndLog(" Modulation : %s", GetModulationStr(datamod
));
840 PrintAndLog(" PSK clock frequency : %d", pskcf
);
841 PrintAndLog(" AOR - Answer on Request : %s", (aor
) ? "Yes":"No");
842 PrintAndLog(" OTP - One Time Pad : %s", (otp
) ? "Yes - Warning":"No" );
843 PrintAndLog(" Max block : %d", maxblk
);
844 PrintAndLog(" Password mode : %s", (pwd
) ? "Yes":"No");
845 PrintAndLog(" Sequence Start Terminator : %s", (sst
) ? "Yes":"No");
846 PrintAndLog(" Fast Write : %s", (fw
) ? "Yes":"No");
847 PrintAndLog(" Inverse data : %s", (inv
) ? "Yes":"No");
848 PrintAndLog(" POR-Delay : %s", (por
) ? "Yes":"No");
849 PrintAndLog("-------------------------------------------------------------");
850 PrintAndLog(" Raw Data - Page 0");
851 PrintAndLog(" Block 0 : 0x%08X %s", bl0
, sprint_bin(DemodBuffer
+config
.offset
,32) );
852 PrintAndLog("-------------------------------------------------------------");
857 int CmdT55xxDump(const char *Cmd
){
860 uint8_t pwd
[4] = {0x00};
862 char cmdp
= param_getchar(Cmd
, 0);
863 if ( cmdp
== 'h' || cmdp
== 'H') {
868 bool hasPwd
= ( strlen(Cmd
) > 0);
870 if (param_gethex(Cmd
, 0, pwd
, 8)) {
871 PrintAndLog("password must include 8 HEX symbols");
876 for ( int i
= 0; i
<8; ++i
){
877 memset(s
,0,sizeof(s
));
879 sprintf(s
,"%d %02x%02x%02x%02x", i
, pwd
[0],pwd
[1],pwd
[2],pwd
[3]);
883 CmdT55xxReadBlock(s
);
888 int AquireData( uint8_t block
){
892 if ( block
== CONFIGURATION_BLOCK
)
893 c
.cmd
= CMD_T55XX_READ_BLOCK
;
894 else if (block
== TRACE_BLOCK
)
895 c
.cmd
= CMD_T55XX_READ_TRACE
;
900 c
.d
.asBytes
[0] = 0x0;
904 // c.arg[2] = password;
905 // c.d.asBytes[0] = 0x1;
909 if ( !WaitForResponseTimeout(CMD_ACK
,NULL
,2500) ) {
910 PrintAndLog("command execution time out");
915 GetFromBigBuf(got
,sizeof(got
),0);
916 WaitForResponse(CMD_ACK
,NULL
);
917 setGraphBuf(got
, 12000);
921 char * GetBitRateStr(uint32_t id
){
926 sprintf(retStr
,"%d - RF/8",id
);
929 sprintf(retStr
,"%d - RF/16",id
);
932 sprintf(retStr
,"%d - RF/32",id
);
935 sprintf(retStr
,"%d - RF/40",id
);
938 sprintf(retStr
,"%d - RF/50",id
);
941 sprintf(retStr
,"%d - RF/64",id
);
944 sprintf(retStr
,"%d - RF/100",id
);
947 sprintf(retStr
,"%d - RF/128",id
);
950 sprintf(retStr
,"%d - (Unknown)",id
);
957 char * GetSaferStr(uint32_t id
){
961 sprintf(retStr
,"%d",id
);
963 sprintf(retStr
,"%d - passwd",id
);
966 sprintf(retStr
,"%d - testmode",id
);
971 char * GetModulationStr( uint32_t id
){
977 sprintf(retStr
,"%d - DIRECT (ASK/NRZ)",id
);
980 sprintf(retStr
,"%d - PSK 1 phase change when input changes",id
);
983 sprintf(retStr
,"%d - PSK 2 phase change on bitclk if input high",id
);
986 sprintf(retStr
,"%d - PSK 3 phase change on rising edge of input",id
);
989 sprintf(retStr
,"%d - FSK 1 RF/8 RF/5",id
);
992 sprintf(retStr
,"%d - FSK 2 RF/8 RF/10",id
);
995 sprintf(retStr
,"%d - FSK 1a RF/5 RF/8",id
);
998 sprintf(retStr
,"%d - FSK 2a RF/10 RF/8",id
);
1001 sprintf(retStr
,"%d - Manschester",id
);
1004 sprintf(retStr
,"%d - Biphase",id
);
1007 sprintf(retStr
,"%d - Biphase a - AKA Conditional Dephase Encoding(CDP)",id
);
1010 sprintf(retStr
,"%d - Reserved",id
);
1013 sprintf(retStr
,"0x%02X (Unknown)",id
);
1019 char * GetModelStrFromCID(uint32_t cid
){
1021 static char buf
[10];
1024 if (cid
== 1) sprintf(retStr
,"ATA5577M1");
1025 if (cid
== 2) sprintf(retStr
,"ATA5577M2");
1029 char * GetSelectedModulationStr( uint8_t id
){
1031 static char buf
[16];
1036 sprintf(retStr
,"FSK");
1039 sprintf(retStr
,"FSK1");
1042 sprintf(retStr
,"FSK1a");
1045 sprintf(retStr
,"FSK2");
1048 sprintf(retStr
,"FSK2a");
1051 sprintf(retStr
,"ASK");
1054 sprintf(retStr
,"DIRECT/NRZ");
1057 sprintf(retStr
,"PSK1");
1060 sprintf(retStr
,"PSK2");
1063 sprintf(retStr
,"PSK3");
1066 sprintf(retStr
,"BIPHASE");
1069 sprintf(retStr
,"BIPHASEa - (CDP)");
1072 sprintf(retStr
,"(Unknown)");
1078 uint32_t PackBits(uint8_t start
, uint8_t len
, uint8_t* bits
){
1083 if (len
> 32) return 0;
1086 for (; j
>= 0; --j
, ++i
)
1087 tmp
|= bits
[i
] << j
;
1092 static command_t CommandTable
[] =
1094 {"help", CmdHelp
, 1, "This help"},
1095 {"config", CmdT55xxSetConfig
, 1, "Set/Get T55XX configuration (modulation, inverted, offset, rate)"},
1096 {"detect", CmdT55xxDetect
, 0, "[1] Try detecting the tag modulation from reading the configuration block."},
1097 {"read", CmdT55xxReadBlock
, 0, "<block> [password] -- Read T55xx block data (page 0) [optional password]"},
1098 {"write", CmdT55xxWriteBlock
,0, "<block> <data> [password] -- Write T55xx block data (page 0) [optional password]"},
1099 {"trace", CmdT55xxReadTrace
, 0, "[1] Show T55xx traceability data (page 1/ blk 0-1)"},
1100 {"info", CmdT55xxInfo
, 0, "[1] Show T55xx configuration data (page 0/ blk 0)"},
1101 {"dump", CmdT55xxDump
, 0, "[password] Dump T55xx card block 0-7. [optional password]"},
1102 {"special", special
, 0, "Show block changes with 64 different offsets"},
1103 {NULL
, NULL
, 0, NULL
}
1106 int CmdLFT55XX(const char *Cmd
)
1108 CmdsParse(CommandTable
, Cmd
);
1112 int CmdHelp(const char *Cmd
)
1114 CmdsHelp(CommandTable
);