]> cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlft55xx.c
Change in progress, the adjustments to use Marshmellow's new demod for T55XX commands.
[proxmark3-svn] / client / cmdlft55xx.c
1 //-----------------------------------------------------------------------------
2 //
3 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
4 // at your option, any later version. See the LICENSE.txt file for the text of
5 // the license.
6 //-----------------------------------------------------------------------------
7 // Low frequency T55xx commands
8 //-----------------------------------------------------------------------------
9
10 #include <stdio.h>
11 #include <string.h>
12 #include <inttypes.h>
13 #include "proxmark3.h"
14 #include "ui.h"
15 #include "graph.h"
16 #include "cmdmain.h"
17 #include "cmdparser.h"
18 #include "cmddata.h"
19 #include "cmdlf.h"
20 #include "cmdlft55xx.h"
21 #include "util.h"
22 #include "data.h"
23 #include "lfdemod.h"
24
25
26 #define LF_TRACE_BUFF_SIZE 20000 // 32 x 32 x 10 (32 bit times numofblock (7), times clock skip..)
27 #define LF_BITSSTREAM_LEN 1000 // more then 1000 bits shouldn't happend.. 8block * 4 bytes * 8bits =
28 static int CmdHelp(const char *Cmd);
29
30 // int CmdReadBlk(const char *Cmd)
31 // {
32 // int block = -1;
33 // sscanf(Cmd, "%d", &block);
34
35 // if ((block > 7) | (block < 0)) {
36 // PrintAndLog("Block must be between 0 and 7");
37 // return 1;
38 // }
39
40 // UsbCommand c;
41 // c.cmd = CMD_T55XX_READ_BLOCK;
42 // c.d.asBytes[0] = 0x00;
43 // c.arg[0] = 0;
44 // c.arg[1] = block;
45 // c.arg[2] = 0;
46 // SendCommand(&c);
47 // WaitForResponse(CMD_ACK, NULL);
48
49 // uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
50
51 // GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,0); //3560 -- should be offset..
52 // WaitForResponseTimeout(CMD_ACK,NULL, 1500);
53
54 // for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
55 // GraphBuffer[j] = (int)data[j];
56 // }
57 // GraphTraceLen = LF_TRACE_BUFF_SIZE;
58 // ManchesterDemod(block);
59 // RepaintGraphWindow();
60 // return 0;
61 // }
62
63 int CmdReadBlk(const char *Cmd)
64 {
65 int invert = 0;
66 int clk = 0;
67 int block = -1;
68 uint8_t bits[MAX_GRAPH_TRACE_LEN] = {0x00};
69
70 sscanf(Cmd, "%d", &block);
71
72 if ((block > 7) | (block < 0)) {
73 PrintAndLog("Block must be between 0 and 7");
74 return 1;
75 }
76
77 UsbCommand c = { CMD_T55XX_READ_BLOCK, { 0, block, 0 } };
78 SendCommand(&c);
79 if ( !WaitForResponseTimeout(CMD_ACK,NULL,1500) ) {
80 PrintAndLog("command execution time out");
81 return 1;
82 }
83
84 CmdSamples("");
85
86 size_t bitlen = getFromGraphBuf(bits);
87
88 int errCnt = askrawdemod(bits, &bitlen, &clk, &invert);
89
90 //throw away static - allow 1 and -1 (in case of threshold command first)
91 if ( errCnt == -1 || bitlen < 16 ){
92 PrintAndLog("no data found");
93 if (g_debugMode)
94 PrintAndLog("errCnt: %d, bitlen: %d, clk: %d, invert: %d", errCnt, bitlen, clk, invert);
95 return 0;
96 }
97 if (g_debugMode)
98 PrintAndLog("Using Clock: %d - invert: %d - Bits Found: %d", clk, invert, bitlen);
99
100 //move bits back to DemodBuffer
101 setDemodBuf(bits, bitlen, 0);
102 printBitStream(bits,bitlen);
103 return 0;
104 }
105
106 int CmdReadBlkPWD(const char *Cmd)
107 {
108 int Block = -1; //default to invalid block
109 int Password = 0xFFFFFFFF; //default to blank Block 7
110
111
112 sscanf(Cmd, "%d %x", &Block, &Password);
113
114 if ((Block > 7) | (Block < 0)) {
115 PrintAndLog("Block must be between 0 and 7");
116 return 1;
117 }
118
119 PrintAndLog("Reading page 0 block %d pwd %08X", Block, Password);
120
121 UsbCommand c = {CMD_T55XX_READ_BLOCK, {0, Block, Password} };
122 c.d.asBytes[0] = 0x1; //Password mode
123 SendCommand(&c);
124 WaitForResponse(CMD_ACK, NULL);
125
126 uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
127
128 GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,0);
129 WaitForResponseTimeout(CMD_ACK,NULL, 1500);
130
131 for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
132 GraphBuffer[j] = ((int)data[j]);
133 }
134 GraphTraceLen = LF_TRACE_BUFF_SIZE;
135 ManchesterDemod(Block);
136
137 RepaintGraphWindow();
138 return 0;
139 }
140
141 int CmdWriteBlk(const char *Cmd)
142 {
143 int Block = 8; //default to invalid block
144 int Data = 0xFFFFFFFF; //default to blank Block
145
146 sscanf(Cmd, "%d %x", &Block, &Data);
147
148 if (Block > 7) {
149 PrintAndLog("Block must be between 0 and 7");
150 return 1;
151 }
152
153 PrintAndLog("Writing block %d data %08X", Block, Data);
154
155 UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {Data, Block, 0}};
156 c.d.asBytes[0] = 0x0; //Normal mode
157 SendCommand(&c);
158 return 0;
159 }
160
161 int CmdWriteBlkPWD(const char *Cmd)
162 {
163 int Block = 8; //default to invalid block
164 int Data = 0xFFFFFFFF; //default to blank Block
165 int Password = 0xFFFFFFFF; //default to blank Block 7
166
167
168 sscanf(Cmd, "%d %x %x",&Block, &Data, &Password);
169
170 if (Block > 7) {
171 PrintAndLog("Block must be between 0 and 7");
172 return 1;
173 }
174
175 PrintAndLog("Writing block %d data %08X password %08X", Block, Data, Password);
176
177 UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {Data, Block, Password}};
178 c.d.asBytes[0] = 0x1; //Password mode
179 SendCommand(&c);
180 return 0;
181 }
182
183 int CmdReadTrace(const char *Cmd)
184 {
185 char cmdp = param_getchar(Cmd, 0);
186
187 if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {
188 PrintAndLog("Usage: lf t55xx trace [use data from Graphbuffer]");
189 PrintAndLog(" [use data from Graphbuffer], if not set, try reading data from tag.");
190 PrintAndLog("");
191 PrintAndLog(" sample: lf t55xx trace");
192 PrintAndLog(" : lf t55xx trace 1");
193 return 0;
194 }
195
196 if ( strlen(Cmd)==0){
197
198 UsbCommand c = {CMD_T55XX_READ_TRACE, {0, 0, 0}};
199 SendCommand(&c);
200 WaitForResponse(CMD_ACK, NULL);
201
202 uint8_t data[LF_TRACE_BUFF_SIZE] = {0x00};
203
204 GetFromBigBuf(data,LF_TRACE_BUFF_SIZE,0); //3560 -- should be offset..
205 WaitForResponseTimeout(CMD_ACK,NULL, 1500);
206
207 for (int j = 0; j < LF_TRACE_BUFF_SIZE; j++) {
208 GraphBuffer[j] = ((int)data[j]);
209 }
210 GraphTraceLen = LF_TRACE_BUFF_SIZE;
211 }
212
213 uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
214 uint8_t * bitstream = bits;
215
216 manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream, LF_BITSSTREAM_LEN);
217 RepaintGraphWindow();
218
219 uint8_t si = 5;
220 uint32_t bl0 = PackBits(si, 32, bitstream);
221 uint32_t bl1 = PackBits(si+32, 32, bitstream);
222
223 uint32_t acl = PackBits(si, 8, bitstream); si += 8;
224 uint32_t mfc = PackBits(si, 8, bitstream); si += 8;
225 uint32_t cid = PackBits(si, 5, bitstream); si += 5;
226 uint32_t icr = PackBits(si, 3, bitstream); si += 3;
227 uint32_t year = PackBits(si, 4, bitstream); si += 4;
228 uint32_t quarter = PackBits(si, 2, bitstream); si += 2;
229 uint32_t lotid = PackBits(si, 12, bitstream); si += 12;
230 uint32_t wafer = PackBits(si, 5, bitstream); si += 5;
231 uint32_t dw = PackBits(si, 15, bitstream);
232
233 PrintAndLog("");
234 PrintAndLog("-- T55xx Trace Information ----------------------------------");
235 PrintAndLog("-------------------------------------------------------------");
236 PrintAndLog(" ACL Allocation class (ISO/IEC 15963-1) : 0x%02X (%d)", acl, acl);
237 PrintAndLog(" MFC Manufacturer ID (ISO/IEC 7816-6) : 0x%02X (%d)", mfc, mfc);
238 PrintAndLog(" CID : 0x%02X (%d)", cid, cid);
239 PrintAndLog(" ICR IC Revision : %d",icr );
240 PrintAndLog(" Manufactured");
241 PrintAndLog(" Year/Quarter : %d/%d",2000+year, quarter );
242 PrintAndLog(" Lot ID : %d", lotid );
243 PrintAndLog(" Wafer number : %d", wafer);
244 PrintAndLog(" Die Number : %d", dw);
245 PrintAndLog("-------------------------------------------------------------");
246 PrintAndLog(" Raw Data - Page 1");
247 PrintAndLog(" Block 0 : 0x%08X %s", bl0, sprint_bin(bitstream+5,32) );
248 PrintAndLog(" Block 0 : 0x%08X %s", bl1, sprint_bin(bitstream+37,32) );
249 PrintAndLog("-------------------------------------------------------------");
250 /*
251 TRACE - BLOCK O
252 Bits Definition HEX
253 1-8 ACL Allocation class (ISO/IEC 15963-1) 0xE0
254 9-16 MFC Manufacturer ID (ISO/IEC 7816-6) 0x15 Atmel Corporation
255 17-21 CID 0x1 = Atmel ATA5577M1 0x2 = Atmel ATA5577M2
256 22-24 ICR IC revision
257 25-28 YEAR (BCD encoded) 9 (= 2009)
258 29-30 QUARTER 1,2,3,4
259 31-32 LOT ID
260
261 TRACE - BLOCK 1
262 1-12 LOT ID
263 13-17 Wafer number
264 18-32 DW, die number sequential
265 */
266
267 return 0;
268 }
269
270 int CmdInfo(const char *Cmd){
271 /*
272 Page 0 Block 0 Configuration data.
273 Normal mode
274 Extended mode
275 */
276 char cmdp = param_getchar(Cmd, 0);
277
278 if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {
279 PrintAndLog("Usage: lf t55xx info [use data from Graphbuffer]");
280 PrintAndLog(" [use data from Graphbuffer], if not set, try reading data from tag.");
281 PrintAndLog("");
282 PrintAndLog(" sample: lf t55xx info");
283 PrintAndLog(" sample: lf t55xx info 1");
284 return 0;
285 }
286
287 if ( strlen(Cmd) == 0 ){
288 CmdReadBlk("0");
289 }
290
291 uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
292
293 manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bits, LF_BITSSTREAM_LEN);
294
295 uint8_t si = 5;
296 uint32_t bl0 = PackBits(si, 32, bits);
297
298 uint32_t safer = PackBits(si, 4, bits); si += 4;
299 uint32_t resv = PackBits(si, 7, bits); si += 7;
300 uint32_t dbr = PackBits(si, 3, bits); si += 3;
301 uint32_t extend = PackBits(si, 1, bits); si += 1;
302 uint32_t datamodulation = PackBits(si, 5, bits); si += 5;
303 uint32_t pskcf = PackBits(si, 2, bits); si += 2;
304 uint32_t aor = PackBits(si, 1, bits); si += 1;
305 uint32_t otp = PackBits(si, 1, bits); si += 1;
306 uint32_t maxblk = PackBits(si, 3, bits); si += 3;
307 uint32_t pwd = PackBits(si, 1, bits); si += 1;
308 uint32_t sst = PackBits(si, 1, bits); si += 1;
309 uint32_t fw = PackBits(si, 1, bits); si += 1;
310 uint32_t inv = PackBits(si, 1, bits); si += 1;
311 uint32_t por = PackBits(si, 1, bits); si += 1;
312
313 PrintAndLog("");
314 PrintAndLog("-- T55xx Configuration & Tag Information --------------------");
315 PrintAndLog("-------------------------------------------------------------");
316 PrintAndLog(" Safer key : %s", GetSaferStr(safer));
317 PrintAndLog(" reserved : %d", resv);
318 PrintAndLog(" Data bit rate : %s", GetBitRateStr(dbr));
319 PrintAndLog(" eXtended mode : %s", (extend) ? "Yes - Warning":"No");
320 PrintAndLog(" Modulation : %s", GetModulationStr(datamodulation) );
321 PrintAndLog(" PSK clock freq : %d", pskcf);
322 PrintAndLog(" AOR - Answer on Request : %s", (aor) ? "Yes":"No");
323 PrintAndLog(" OTP - One Time Pad : %s", (otp) ? "Yes - Warning":"No" );
324 PrintAndLog(" Max block : %d", maxblk);
325 PrintAndLog(" Password mode : %s", (pwd) ? "Yes":"No");
326 PrintAndLog(" Sequence Start Terminator : %s", (sst) ? "Yes":"No");
327 PrintAndLog(" Fast Write : %s", (fw) ? "Yes":"No");
328 PrintAndLog(" Inverse data : %s", (inv) ? "Yes":"No");
329 PrintAndLog(" POR-Delay : %s", (por) ? "Yes":"No");
330 PrintAndLog("-------------------------------------------------------------");
331 PrintAndLog(" Raw Data - Page 0");
332 PrintAndLog(" Block 0 : 0x%08X %s", bl0, sprint_bin(bits+5,32) );
333 PrintAndLog("-------------------------------------------------------------");
334
335 return 0;
336 }
337
338 int CmdDump(const char *Cmd){
339
340 char cmdp = param_getchar(Cmd, 0);
341 char s[20];
342 uint8_t pwd[4] = {0x00};
343 bool hasPwd = ( strlen(Cmd) > 0);
344
345 if ( cmdp == 'h' || cmdp == 'H') {
346 PrintAndLog("Usage: lf t55xx dump <password>");
347 PrintAndLog(" sample: lf t55xx dump FFFFFFFF");
348 return 0;
349 }
350
351 if ( hasPwd ){
352 if (param_gethex(Cmd, 0, pwd, 8)) {
353 PrintAndLog("password must include 8 HEX symbols");
354 return 1;
355 }
356 }
357
358 for ( int i = 0; i <8; ++i){
359 memset(s,0,sizeof(s));
360 if ( hasPwd ) {
361 sprintf(s,"%d %02x%02x%02x%02x", i, pwd[0],pwd[1],pwd[2],pwd[3]);
362 CmdReadBlkPWD(s);
363 } else {
364 sprintf(s,"%d", i);
365 CmdReadBlk(s);
366 }
367 }
368 return 0;
369 }
370
371 int CmdIceFsk(const char *Cmd){
372
373 if (!HasGraphData()) return 0;
374
375 iceFsk3(GraphBuffer, LF_TRACE_BUFF_SIZE);
376 RepaintGraphWindow();
377 return 0;
378 }
379 int CmdIceManchester(const char *Cmd){
380 ManchesterDemod( -1);
381 return 0;
382 }
383 int ManchesterDemod(int blockNum){
384
385 if (!HasGraphData()) return 0;
386
387 uint8_t sizebyte = 32;
388 // the value 5 was selected during empirical studies of the decoded data. Some signal noise to skip.
389 uint8_t offset = 5;
390 uint32_t blockData;
391 uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};
392 uint8_t * bitstream = bits;
393
394 //manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bitstream, LF_BITSSTREAM_LEN);
395 manchester_decode(GraphBuffer, LF_TRACE_BUFF_SIZE, bits, LF_BITSSTREAM_LEN);
396 //blockData = PackBits(offset, sizebyte, bitstream);
397 blockData = PackBits(offset, sizebyte, bits);
398
399 if ( blockNum < 0)
400 PrintAndLog(" Decoded : 0x%08X %s", blockData, sprint_bin(bitstream+offset,sizebyte) );
401 else
402 PrintAndLog(" Block %d : 0x%08X %s", blockNum, blockData, sprint_bin(bitstream+offset,sizebyte) );
403
404 return 0;
405 }
406
407 char * GetBitRateStr(uint32_t id){
408 static char buf[40];
409 char *retStr = buf;
410 switch (id){
411 case 0:
412 sprintf(retStr,"%d - RF/8",id);
413 break;
414 case 1:
415 sprintf(retStr,"%d - RF/16",id);
416 break;
417 case 2:
418 sprintf(retStr,"%d - RF/32",id);
419 break;
420 case 3:
421 sprintf(retStr,"%d - RF/40",id);
422 break;
423 case 4:
424 sprintf(retStr,"%d - RF/50",id);
425 break;
426 case 5:
427 sprintf(retStr,"%d - RF/64",id);
428 break;
429 case 6:
430 sprintf(retStr,"%d - RF/100",id);
431 break;
432 case 7:
433 sprintf(retStr,"%d - RF/128",id);
434 break;
435 default:
436 sprintf(retStr,"%d - (Unknown)",id);
437 break;
438 }
439
440 return buf;
441 }
442
443 char * GetSaferStr(uint32_t id){
444 static char buf[40];
445 char *retStr = buf;
446
447 sprintf(retStr,"%d",id);
448 if (id == 6) {
449 sprintf(retStr,"%d - pasdwd",id);
450 }
451 if (id == 9 ){
452 sprintf(retStr,"%d - testmode ",id);
453 }
454
455 return buf;
456 }
457 char * GetModulationStr( uint32_t id){
458 static char buf[40];
459 char *retStr = buf;
460
461 switch (id){
462 case 0:
463 sprintf(retStr,"%d - DIRECT (ASK/NRZ)",id);
464 break;
465 case 1:
466 sprintf(retStr,"%d - PSK 1 phase change when input changes",id);
467 break;
468 case 2:
469 sprintf(retStr,"%d - PSK 2 phase change on bitclk if input high",id);
470 break;
471 case 3:
472 sprintf(retStr,"%d - PSK 3 phase change on rising edge of input",id);
473 break;
474 case 4:
475 sprintf(retStr,"%d - FSK 1 RF/8 RF/5",id);
476 break;
477 case 5:
478 sprintf(retStr,"%d - FSK 2 RF/8 RF/10",id);
479 break;
480 case 6:
481 sprintf(retStr,"%d - FSK 1a RF/5 RF/8",id);
482 break;
483 case 7:
484 sprintf(retStr,"%d - FSK 2a RF/10 RF/8",id);
485 break;
486 case 8:
487 sprintf(retStr,"%d - Manschester",id);
488 break;
489 case 16:
490 sprintf(retStr,"%d - Biphase",id);
491 break;
492 case 17:
493 sprintf(retStr,"%d - Reserved",id);
494 break;
495 default:
496 sprintf(retStr,"0x%02X (Unknown)",id);
497 break;
498 }
499 return buf;
500 }
501
502
503 uint32_t PackBits(uint8_t start, uint8_t len, uint8_t* bits){
504
505 int i = start;
506 int j = len-1;
507 if (len > 32) {
508 return 0;
509 }
510 uint32_t tmp = 0;
511 for (; j >= 0; --j, ++i){
512 tmp |= bits[i] << j;
513 }
514 return tmp;
515 }
516
517 static command_t CommandTable[] =
518 {
519 {"help", CmdHelp, 1, "This help"},
520 {"rd", CmdReadBlk, 0, "<block> -- Read T55xx block data (page 0)"},
521 {"rdpwd", CmdReadBlkPWD, 0, "<block> <password> -- Read T55xx block data with password mode"},
522 {"wr", CmdWriteBlk, 0, "<block> <data> -- Write T55xx block data (page 0)"},
523 {"wrpwd", CmdWriteBlkPWD, 0, "<block> <password> <data> -- Write T55xx block data with password"},
524 {"trace", CmdReadTrace, 0, "[1] Read T55xx traceability data (page 1/ blk 0-1)"},
525 {"info", CmdInfo, 0, "[1] Read T55xx configuration data (page 0/ blk 0)"},
526 {"dump", CmdDump, 0, "[password] Dump T55xx card block 0-7. optional with password"},
527 {"fsk", CmdIceFsk, 0, "FSK demod"},
528 {"man", CmdIceManchester, 0, "Manchester demod (with SST)"},
529 {NULL, NULL, 0, NULL}
530 };
531
532 int CmdLFT55XX(const char *Cmd)
533 {
534 CmdsParse(CommandTable, Cmd);
535 return 0;
536 }
537
538 int CmdHelp(const char *Cmd)
539 {
540 CmdsHelp(CommandTable);
541 return 0;
542 }
Impressum, Datenschutz