cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlft55xx.c

   1 //-----------------------------------------------------------------------------
   2 //
   3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   4 // at your option, any later version. See the LICENSE.txt file for the text of
   5 // the license.
   6 //-----------------------------------------------------------------------------
   7 // Low frequency T55xx commands
   8 //-----------------------------------------------------------------------------
   9
  10 #include <stdio.h>
  11 #include <string.h>
  12 #include <inttypes.h>
  13 #include "proxmark3.h"
  14 #include "ui.h"
  15 #include "graph.h"
  16 #include "cmdmain.h"
  17 #include "cmdparser.h"
  18 #include "cmddata.h"
  19 #include "cmdlf.h"
  20 #include "cmdlft55xx.h"
  21 #include "util.h"
  22 #include "data.h"
  23
  24
  25 #define LF_TRACE_BUFF_SIZE 12000 // 32 x 32 x 10  (32 bit times numofblock (7), times clock skip..)
  26 static int CmdHelp(const char *Cmd);
  27
  28
  29 int CmdReadBlk(const char *Cmd)
  30 {
  31         int Block = -1;
  32
  33         sscanf(Cmd, "%d", &Block);
  34
  35         if ((Block > 7) | (Block < 0)) {
  36                 PrintAndLog("Block must be between 0 and 7");
  37                 return 1;
  38         }
  39
  40         // this command fills up BigBuff
  41         UsbCommand c;
  42         c.cmd = CMD_T55XX_READ_BLOCK;
  43         c.d.asBytes[0] = 0x00;
  44         c.arg[0] = 0;
  45         c.arg[1] = Block;
  46         c.arg[2] = 0;
  47         SendCommand(&c);
  48         WaitForResponse(CMD_ACK, NULL);
  49
  50         uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
  51
  52         GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560);  //3560 -- should be offset..
  53         WaitForResponseTimeout(CMD_ACK,NULL, 1500);
  54
  55         for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
  56                 GraphBuffer[j] = (int)data[j];
  57         }
  58         GraphTraceLen = LF_TRACE_BUFF_SIZE;
  59         ManchesterDemod(Block);
  60         RepaintGraphWindow();
  61   return 0;
  62 }
  63
  64 int CmdReadBlkPWD(const char *Cmd)
  65 {
  66         int Block = -1; //default to invalid block
  67         int Password = 0xFFFFFFFF; //default to blank Block 7
  68         UsbCommand c;
  69
  70         sscanf(Cmd, "%d %x", &Block, &Password);
  71
  72         if ((Block > 7) | (Block < 0)) {
  73                 PrintAndLog("Block must be between 0 and 7");
  74                 return 1;
  75         }
  76
  77         PrintAndLog("Reading page 0 block %d pwd %08X", Block, Password);
  78
  79         c.cmd = CMD_T55XX_READ_BLOCK;
  80         c.d.asBytes[0] = 0x1; //Password mode
  81         c.arg[0] = 0;
  82         c.arg[1] = Block;
  83         c.arg[2] = Password;
  84         SendCommand(&c);
  85         WaitForResponse(CMD_ACK, NULL);
  86
  87         uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
  88
  89         GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560);  //3560 -- should be offset..
  90         WaitForResponseTimeout(CMD_ACK,NULL, 1500);
  91
  92         for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
  93                 GraphBuffer[j] = ((int)data[j]) - 128;
  94         }
  95         GraphTraceLen = LF_TRACE_BUFF_SIZE;
  96         ManchesterDemod(Block);
  97         RepaintGraphWindow();
  98   return 0;
  99 }
 100
 101 int CmdWriteBlk(const char *Cmd)
 102 {
 103   int Block = 8; //default to invalid block
 104   int Data = 0xFFFFFFFF; //default to blank Block
 105   UsbCommand c;
 106
 107   sscanf(Cmd, "%x %d", &Data, &Block);
 108
 109   if (Block > 7) {
 110         PrintAndLog("Block must be between 0 and 7");
 111         return 1;
 112   }
 113
 114   PrintAndLog("Writting block %d with data %08X", Block, Data);
 115
 116   c.cmd = CMD_T55XX_WRITE_BLOCK;
 117   c.d.asBytes[0] = 0x0; //Normal mode
 118   c.arg[0] = Data;
 119   c.arg[1] = Block;
 120   c.arg[2] = 0;
 121   SendCommand(&c);
 122   return 0;
 123 }
 124
 125 int CmdWriteBlkPWD(const char *Cmd)
 126 {
 127   int Block = 8; //default to invalid block
 128   int Data = 0xFFFFFFFF; //default to blank Block
 129   int Password = 0xFFFFFFFF; //default to blank Block 7
 130   UsbCommand c;
 131
 132   sscanf(Cmd, "%x %d %x", &Data, &Block, &Password);
 133
 134   if (Block > 7) {
 135         PrintAndLog("Block must be between 0 and 7");
 136         return 1;
 137   }
 138
 139   PrintAndLog("Writting block %d with data %08X and password %08X", Block, Data, Password);
 140
 141   c.cmd = CMD_T55XX_WRITE_BLOCK;
 142   c.d.asBytes[0] = 0x1; //Password mode
 143   c.arg[0] = Data;
 144   c.arg[1] = Block;
 145   c.arg[2] = Password;
 146   SendCommand(&c);
 147   return 0;
 148 }
 149
 150 int CmdReadTrace(const char *Cmd)
 151 {
 152         char cmdp = param_getchar(Cmd, 0);
 153
 154         if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {
 155                 PrintAndLog("Usage:  lf t55xx trace  [use data from Graphbuffer]");
 156                 PrintAndLog("     [use data from Graphbuffer], if not set, try reading data from tag.");
 157                 PrintAndLog("");
 158                 PrintAndLog("        sample: lf t55xx trace");
 159                 PrintAndLog("        sample: lf t55xx trace 1");
 160                 return 0;
 161         }
 162
 163         if ( strlen(Cmd)==0){
 164                 UsbCommand c = {CMD_T55XX_READ_TRACE, {0, 0, 0}};
 165                 SendCommand(&c);
 166                 WaitForResponse(CMD_ACK, NULL);
 167
 168                 uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
 169
 170                 GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,3560);  //3560 -- should be offset..
 171                 WaitForResponseTimeout(CMD_ACK,NULL, 1500);
 172
 173                 for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
 174                         GraphBuffer[j] = ((int)data[j]);
 175                 }
 176                 GraphTraceLen = LF_TRACE_BUFF_SIZE;
 177         }
 178
 179         uint8_t bits[1000] = {0x00};
 180         uint8_t * bitstream = bits;
 181
 182         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream);
 183         RepaintGraphWindow();
 184
 185         uint8_t si = 5;
 186         uint32_t bl0     = PackBits(si, 32, bitstream);
 187         uint32_t bl1     = PackBits(si+32, 32, bitstream);
 188
 189         uint32_t acl     = PackBits(si,  8, bitstream); si += 8;
 190         uint32_t mfc     = PackBits(si, 8, bitstream); si += 8;
 191         uint32_t cid     = PackBits(si, 5, bitstream); si += 5;
 192         uint32_t icr     = PackBits(si, 3, bitstream); si += 3;
 193         uint32_t year    = PackBits(si, 4, bitstream); si += 4;
 194         uint32_t quarter = PackBits(si, 2, bitstream); si += 2;
 195         uint32_t lotid    = PackBits(si, 12, bitstream); si += 12;
 196         uint32_t wafer   = PackBits(si, 5, bitstream); si += 5;
 197         uint32_t dw      = PackBits(si, 15, bitstream);
 198
 199         PrintAndLog("");
 200         PrintAndLog("-- T55xx Trace Information ----------------------------------");
 201         PrintAndLog("-------------------------------------------------------------");
 202         PrintAndLog(" ACL Allocation class (ISO/IEC 15963-1)  : 0x%02X (%d)", acl, acl);
 203         PrintAndLog(" MFC Manufacturer ID (ISO/IEC 7816-6)    : 0x%02X (%d)", mfc, mfc);
 204         PrintAndLog(" CID                                     : 0x%02X (%d)", cid, cid);
 205         PrintAndLog(" ICR IC Revision                         : %d",icr );
 206         PrintAndLog(" Manufactured");
 207         PrintAndLog("     Year/Quarter : %d/%d",2000+year, quarter );
 208         PrintAndLog("     Lot ID       : %d", lotid );
 209         PrintAndLog("     Wafer number : %d", wafer);
 210         PrintAndLog("     Die Number   : %d", dw);
 211         PrintAndLog("-------------------------------------------------------------");
 212         PrintAndLog(" Raw Data - Page 1");
 213         PrintAndLog("     Block 0  : 0x%08X  %s", bl0, sprint_bin(bitstream+5,32) );
 214         PrintAndLog("     Block 0  : 0x%08X  %s", bl1, sprint_bin(bitstream+37,32) );
 215         PrintAndLog("-------------------------------------------------------------");
 216         /*
 217         TRACE - BLOCK O
 218                 Bits    Definition                                                              HEX
 219                 1-8             ACL Allocation class (ISO/IEC 15963-1)  0xE0
 220                 9-16    MFC Manufacturer ID (ISO/IEC 7816-6)    0x15 Atmel Corporation
 221                 17-21   CID                                                                             0x1 = Atmel ATA5577M1  0x2 = Atmel ATA5577M2
 222                 22-24   ICR IC revision
 223                 25-28   YEAR (BCD encoded)                                              9 (= 2009)
 224                 29-30   QUARTER                                                                 1,2,3,4
 225                 31-32   LOT ID
 226
 227         TRACE - BLOCK 1
 228                 1-12    LOT ID
 229                 13-17   Wafer number
 230                 18-32   DW,  die number sequential
 231         */
 232
 233   return 0;
 234 }
 235
 236 int CmdInfo(const char *Cmd){
 237         /*
 238                 Page 0 Block 0 Configuration data.
 239                 Normal mode
 240                 Extended mode
 241         */
 242         char cmdp = param_getchar(Cmd, 0);
 243
 244         if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {
 245                 PrintAndLog("Usage:  lf t55xx info  [use data from Graphbuffer]");
 246                 PrintAndLog("     [use data from Graphbuffer], if not set, try reading data from tag.");
 247                 PrintAndLog("");
 248                 PrintAndLog("        sample: lf t55xx info");
 249                 PrintAndLog("        sample: lf t55xx info 1");
 250                 return 0;
 251         }
 252
 253         if ( strlen(Cmd)==0){
 254                 CmdReadBlk("0");
 255         }
 256
 257
 258         uint8_t bits[1000] = {0x00};
 259         uint8_t * bitstream = bits;
 260
 261         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream);
 262
 263         uint8_t si = 5;
 264         uint32_t bl0      = PackBits(si, 32, bitstream);
 265
 266         uint32_t safer    = PackBits(si, 4, bitstream); si += 4;
 267         uint32_t resv     = PackBits(si, 7, bitstream); si += 7;
 268         uint32_t dbr      = PackBits(si, 3, bitstream); si += 3;
 269         uint32_t extend   = PackBits(si, 1, bitstream); si += 1;
 270         uint32_t datamodulation   = PackBits(si, 5, bitstream); si += 5;
 271         uint32_t pskcf    = PackBits(si, 2, bitstream); si += 2;
 272         uint32_t aor      = PackBits(si, 1, bitstream); si += 1;
 273         uint32_t otp      = PackBits(si, 1, bitstream); si += 1;
 274         uint32_t maxblk   = PackBits(si, 3, bitstream); si += 3;
 275         uint32_t pwd      = PackBits(si, 1, bitstream); si += 1;
 276         uint32_t sst      = PackBits(si, 1, bitstream); si += 1;
 277         uint32_t fw       = PackBits(si, 1, bitstream); si += 1;
 278         uint32_t inv      = PackBits(si, 1, bitstream); si += 1;
 279         uint32_t por      = PackBits(si, 1, bitstream); si += 1;
 280
 281         PrintAndLog("");
 282         PrintAndLog("-- T55xx Configuration --------------------------------------");
 283         PrintAndLog("-------------------------------------------------------------");
 284         PrintAndLog(" Safer key                 : %s", GetSaferStr(safer));
 285         PrintAndLog(" reserved                  : %d", resv);
 286         PrintAndLog(" Data bit rate             : %s", GetBitRateStr(dbr));
 287         PrintAndLog(" eXtended mode             : %s", (extend) ? "Yes - Warning":"No");
 288         PrintAndLog(" Modulation                : %s", GetModulationStr(datamodulation) );
 289         PrintAndLog(" PSK clock freq            : %d", pskcf);
 290         PrintAndLog(" AOR - Answer on Request   : %s", (aor) ? "Yes":"No");
 291         PrintAndLog(" OTP - One Time Pad        : %s", (otp) ? "Yes - Warning":"No" );
 292         PrintAndLog(" Max block                 : %d", maxblk);
 293         PrintAndLog(" Password mode             : %s", (pwd) ? "Yes":"No");
 294         PrintAndLog(" Sequence Start Terminator : %s", (sst) ? "Yes":"No");
 295         PrintAndLog(" Fast Write                : %s", (fw) ? "Yes":"No");
 296         PrintAndLog(" Inverse data              : %s", (inv) ? "Yes":"No");
 297         PrintAndLog(" POR-Delay                 : %s", (por) ? "Yes":"No");
 298         PrintAndLog("-------------------------------------------------------------");
 299         PrintAndLog(" Raw Data - Page 0");
 300         PrintAndLog("     Block 0  : 0x%08X  %s", bl0, sprint_bin(bitstream+5,32) );
 301         PrintAndLog("-------------------------------------------------------------");
 302
 303         return 0;
 304 }
 305
 306 int CmdDump(const char *Cmd){
 307
 308         char cmdp = param_getchar(Cmd, 0);
 309         char s[20];
 310         uint8_t pwd[4] = {0x00};
 311
 312         if (strlen(Cmd)>1 || cmdp == 'h' || cmdp == 'H') {
 313                 PrintAndLog("Usage:  lf t55xx dump <password>");
 314                 PrintAndLog("        sample: lf t55xx dump FFFFFFFF");
 315                 return 0;
 316         }
 317
 318         bool hasPwd = ( strlen(Cmd) > 0);
 319
 320         if ( hasPwd ){
 321                 if (param_gethex(Cmd, 0, pwd, 4)) {
 322                         PrintAndLog("password must include 4 HEX symbols");
 323                         return 0;
 324                 }
 325         }
 326
 327         for ( int i = 0; i <8; ++i){
 328                 *s = 0;
 329                 if ( hasPwd ) {
 330                         sprintf(s,"%d %d", i, pwd);
 331                         CmdReadBlkPWD(s);
 332                 } else {
 333                         sprintf(s,"%d", i);
 334                         CmdReadBlk(s);
 335                 }
 336         }
 337         return 0;
 338 }
 339
 340 int CmdIceFsk(const char *Cmd){
 341         iceFsk3(GraphBuffer, LF_TRACE_BUFF_SIZE);
 342         RepaintGraphWindow();
 343         return 0;
 344 }
 345 int CmdIceManchester(const char *Cmd){
 346         ManchesterDemod( -1);
 347         return 0;
 348 }
 349 int ManchesterDemod(int block){
 350
 351         int  blockNum = -1;
 352         uint32_t blockData;
 353         uint8_t  bits[1000] = {0x00};
 354         uint8_t * bitstream = bits;
 355
 356         manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream);
 357     blockData = PackBits(5, 32, bitstream);
 358
 359         if ( blockNum > -1){
 360                 PrintAndLog("   Block %d : 0x%08X  %s", blockNum, blockData, sprint_bin(bitstream+5,32) );
 361         }else{
 362                 PrintAndLog("   Decoded : 0x%08X  %s", blockData, sprint_bin(bitstream+5,32) );
 363         }
 364         return 0;
 365 }
 366
 367 char * GetBitRateStr(uint32_t id){
 368         static char buf[40];
 369         char *retStr = buf;
 370                 switch (id){
 371                 case 0:
 372                         sprintf(retStr,"%d - RF/8",id);
 373                         break;
 374                 case 1:
 375                         sprintf(retStr,"%d - RF/16",id);
 376                         break;
 377                 case 2:
 378                         sprintf(retStr,"%d - RF/32",id);
 379                         break;
 380                 case 3:
 381                         sprintf(retStr,"%d - RF/40",id);
 382                         break;
 383                 case 4:
 384                         sprintf(retStr,"%d - RF/50",id);
 385                         break;
 386                 case 5:
 387                         sprintf(retStr,"%d - RF/64",id);
 388                         break;
 389                 case 6:
 390                         sprintf(retStr,"%d - RF/100",id);
 391                         break;
 392                 case 7:
 393                         sprintf(retStr,"%d - RF/128",id);
 394                         break;
 395                 default:
 396                         sprintf(retStr,"%d - (Unknown)",id);
 397                         break;
 398                 }
 399
 400         return buf;
 401 }
 402
 403 char * GetSaferStr(uint32_t id){
 404         static char buf[40];
 405         char *retStr = buf;
 406
 407         sprintf(retStr,"%d",id);
 408         if (id == 6) {
 409                 sprintf(retStr,"%d - pasdwd",id);
 410         }
 411         if (id == 9 ){
 412                 sprintf(retStr,"%d - testmode ",id);
 413         }
 414
 415         return buf;
 416 }
 417 char * GetModulationStr( uint32_t id){
 418         static char buf[40];
 419         char *retStr = buf;
 420
 421         switch (id){
 422                 case 0:
 423                         sprintf(retStr,"%d - DIRECT (ASK/NRZ)",id);
 424                         break;
 425                 case 1:
 426                         sprintf(retStr,"%d - PSK 1 phase change when input changes",id);
 427                         break;
 428                 case 2:
 429                         sprintf(retStr,"%d - PSK 2 phase change on bitclk if input high",id);
 430                         break;
 431                 case 3:
 432                         sprintf(retStr,"%d - PSK 3 phase change on rising edge of input",id);
 433                         break;
 434                 case 4:
 435                         sprintf(retStr,"%d - FSK 1 RF/8  RF/5",id);
 436                         break;
 437                 case 5:
 438                         sprintf(retStr,"%d - FSK 2 RF/8  RF/10",id);
 439                         break;
 440                 case 6:
 441                         sprintf(retStr,"%d - FSK 1a RF/5  RF/8",id);
 442                         break;
 443                 case 7:
 444                         sprintf(retStr,"%d - FSK 2a RF/10  RF/8",id);
 445                         break;
 446                 case 8:
 447                         sprintf(retStr,"%d - Manschester",id);
 448                         break;
 449                 case 16:
 450                         sprintf(retStr,"%d - Biphase",id);
 451                         break;
 452                 case 17:
 453                         sprintf(retStr,"%d - Reserved",id);
 454                         break;
 455                 default:
 456                         sprintf(retStr,"0x%02X (Unknown)",id);
 457                         break;
 458                 }
 459         return buf;
 460 }
 461
 462
 463 uint32_t PackBits(uint8_t start, uint8_t len, uint8_t* bits){
 464
 465         int i = start;
 466         int j = len-1;
 467         uint32_t tmp = 0;
 468         for (; j >= 0; --j, ++i){
 469                 tmp     |= bits[i] << j;
 470         }
 471         return tmp;
 472 }
 473
 474 static command_t CommandTable[] =
 475 {
 476   {"help",   CmdHelp,        1, "This help"},
 477   {"rd",     CmdReadBlk,     0, "<block> -- Read T55xx block data (page 0)"},
 478   {"rdpwd",  CmdReadBlkPWD,  0, "<block> <password> -- Read T55xx block data with password mode"},
 479   {"wr",     CmdWriteBlk,    0, "<data> <block> -- Write T55xx block data (page 0)"},
 480   {"wrpwd",  CmdWriteBlkPWD, 0, "<data> <block> <password> -- Write T55xx block data with password"},
 481   {"trace",  CmdReadTrace,   0, "[1] Read T55xx traceability data (page 1 / blk 0-1) "},
 482   {"info",   CmdInfo,        0, "[1] Read T55xx configuration data (page0 /blk 0)"},
 483   {"dump",   CmdDump,        0, "[password] Dump T55xx card block 0-7. optional with password"},
 484   {"fsk",    CmdIceFsk,      0, "FSK demod"},
 485   {"man",    CmdIceManchester,      0, "Manchester demod (with SST)"},
 486   {NULL, NULL, 0, NULL}
 487 };
 488
 489 int CmdLFT55XX(const char *Cmd)
 490 {
 491   CmdsParse(CommandTable, Cmd);
 492   return 0;
 493 }
 494
 495 int CmdHelp(const char *Cmd)
 496 {
 497   CmdsHelp(CommandTable);
 498   return 0;
 499 }