]> cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlf.c
projects / proxmark3-svn / blob
? search:


c67f34a8491a905397d23c6d70b17853d0b010fa
[proxmark3-svn] / client / cmdlf.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // Low frequency commands
9 //-----------------------------------------------------------------------------
10
11 #include <stdio.h>
12 #include <stdlib.h>
13 #include <string.h>
14 #include <limits.h>
15 #include "proxmark3.h"
16 #include "data.h"
17 #include "graph.h"
18 #include "ui.h"
19 #include "cmdparser.h"
20 #include "cmdmain.h"
21 #include "cmddata.h"
22 #include "util.h"
23 #include "cmdlf.h"
24 #include "cmdlfhid.h"
25 #include "cmdlfawid.h"
26 #include "cmdlfti.h"
27 #include "cmdlfem4x.h"
28 #include "cmdlfhitag.h"
29 #include "cmdlft55xx.h"
30 #include "cmdlfpcf7931.h"
31 #include "cmdlfio.h"
32 #include "lfdemod.h"
33 #include "cmdlfviking.h"
34 static int CmdHelp(const char *Cmd);
35
36
37 int usage_lf_cmdread()
38 {
39 PrintAndLog("Usage: lf cmdread <delay off> <zero> <one> <cmdbytes> [H] ");
40 PrintAndLog("Options: ");
41 PrintAndLog(" h This help");
42 PrintAndLog(" L Low frequency (125 KHz)");
43 PrintAndLog(" H High frequency (134 KHz)");
44 PrintAndLog(" H delay OFF");
45 PrintAndLog(" H time period ZERO");
46 PrintAndLog(" H time period ONE");
47 PrintAndLog("Examples:");
48 PrintAndLog(" lf cmdread 80 100 200 11000");
49 PrintAndLog(" lf cmdread 80 100 100 11000 H");
50 return 0;
51 }
52
53 /* send a command before reading */
54 int CmdLFCommandRead(const char *Cmd)
55 {
56 static char dummy[3] = {0x20,0x00,0x00};
57 bool errors = FALSE;
58 uint8_t divisor = 0; //125khz
59 uint8_t cmdp =0;
60 while(param_getchar(Cmd, cmdp) != 0x00)
61 {
62 switch(param_getchar(Cmd, cmdp))
63 {
64 case 'h':
65 return usage_lf_cmdread();
66 case 'H':
67 divisor = 88;
68 cmdp++;
69 break;
70 case 'a':
71 //param_getchar(Cmd, cmdp+1) == '1';
72 cmdp+=2;
73 break;
74 default:
75 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
76 errors = 1;
77 break;
78 }
79 if(errors) break;
80 }
81 // No args
82 if(cmdp == 0) errors = 1;
83
84 //Validations
85 if(errors) return usage_lf_cmdread();
86
87 UsbCommand c = {CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K};
88
89 sscanf(Cmd, "%"lli" %"lli" %"lli" %s %s", &c.arg[0], &c.arg[1], &c.arg[2],(char*)(&c.d.asBytes),(char*)(&dummy+1));
90
91 // in case they specified 'h'
92 strcpy((char *)&c.d.asBytes + strlen((char *)c.d.asBytes), dummy);
93
94 PrintAndLog("ICE: %d %s -- %s", strlen((char *)c.d.asBytes) ,dummy, c.d.asBytes);
95 clearCommandBuffer();
96 SendCommand(&c);
97 return 0;
98 }
99
100 int CmdFlexdemod(const char *Cmd)
101 {
102 int i;
103 for (i = 0; i < GraphTraceLen; ++i) {
104 if (GraphBuffer[i] < 0) {
105 GraphBuffer[i] = -1;
106 } else {
107 GraphBuffer[i] = 1;
108 }
109 }
110
111 #define LONG_WAIT 100
112 int start;
113 for (start = 0; start < GraphTraceLen - LONG_WAIT; start++) {
114 int first = GraphBuffer[start];
115 for (i = start; i < start + LONG_WAIT; i++) {
116 if (GraphBuffer[i] != first) {
117 break;
118 }
119 }
120 if (i == (start + LONG_WAIT)) {
121 break;
122 }
123 }
124 if (start == GraphTraceLen - LONG_WAIT) {
125 PrintAndLog("nothing to wait for");
126 return 0;
127 }
128
129 GraphBuffer[start] = 2;
130 GraphBuffer[start+1] = -2;
131 uint8_t bits[64] = {0x00};
132
133 int bit, sum;
134 i = start;
135 for (bit = 0; bit < 64; bit++) {
136 sum = 0;
137 for (int j = 0; j < 16; j++) {
138 sum += GraphBuffer[i++];
139 }
140
141 bits[bit] = (sum > 0) ? 1 : 0;
142
143 PrintAndLog("bit %d sum %d", bit, sum);
144 }
145
146 for (bit = 0; bit < 64; bit++) {
147 int j;
148 int sum = 0;
149 for (j = 0; j < 16; j++) {
150 sum += GraphBuffer[i++];
151 }
152 if (sum > 0 && bits[bit] != 1) {
153 PrintAndLog("oops1 at %d", bit);
154 }
155 if (sum < 0 && bits[bit] != 0) {
156 PrintAndLog("oops2 at %d", bit);
157 }
158 }
159
160 // HACK writing back to graphbuffer.
161 GraphTraceLen = 32*64;
162 i = 0;
163 int phase = 0;
164 for (bit = 0; bit < 64; bit++) {
165
166 phase = (bits[bit] == 0) ? 0 : 1;
167
168 int j;
169 for (j = 0; j < 32; j++) {
170 GraphBuffer[i++] = phase;
171 phase = !phase;
172 }
173 }
174
175 RepaintGraphWindow();
176 return 0;
177 }
178
179 int CmdIndalaDemod(const char *Cmd)
180 {
181 // Usage: recover 64bit UID by default, specify "224" as arg to recover a 224bit UID
182
183 int state = -1;
184 int count = 0;
185 int i, j;
186
187 // worst case with GraphTraceLen=64000 is < 4096
188 // under normal conditions it's < 2048
189
190 uint8_t rawbits[4096];
191 int rawbit = 0;
192 int worst = 0, worstPos = 0;
193 // PrintAndLog("Expecting a bit less than %d raw bits", GraphTraceLen / 32);
194 for (i = 0; i < GraphTraceLen-1; i += 2) {
195 count += 1;
196 if ((GraphBuffer[i] > GraphBuffer[i + 1]) && (state != 1)) {
197 if (state == 0) {
198 for (j = 0; j < count - 8; j += 16) {
199 rawbits[rawbit++] = 0;
200 }
201 if ((abs(count - j)) > worst) {
202 worst = abs(count - j);
203 worstPos = i;
204 }
205 }
206 state = 1;
207 count = 0;
208 } else if ((GraphBuffer[i] < GraphBuffer[i + 1]) && (state != 0)) {
209 if (state == 1) {
210 for (j = 0; j < count - 8; j += 16) {
211 rawbits[rawbit++] = 1;
212 }
213 if ((abs(count - j)) > worst) {
214 worst = abs(count - j);
215 worstPos = i;
216 }
217 }
218 state = 0;
219 count = 0;
220 }
221 }
222
223 if (rawbit>0){
224 PrintAndLog("Recovered %d raw bits, expected: %d", rawbit, GraphTraceLen/32);
225 PrintAndLog("worst metric (0=best..7=worst): %d at pos %d", worst, worstPos);
226 } else {
227 return 0;
228 }
229
230 // Finding the start of a UID
231 int uidlen, long_wait;
232 if (strcmp(Cmd, "224") == 0) {
233 uidlen = 224;
234 long_wait = 30;
235 } else {
236 uidlen = 64;
237 long_wait = 29;
238 }
239
240 int start;
241 int first = 0;
242 for (start = 0; start <= rawbit - uidlen; start++) {
243 first = rawbits[start];
244 for (i = start; i < start + long_wait; i++) {
245 if (rawbits[i] != first) {
246 break;
247 }
248 }
249 if (i == (start + long_wait)) {
250 break;
251 }
252 }
253
254 if (start == rawbit - uidlen + 1) {
255 PrintAndLog("nothing to wait for");
256 return 0;
257 }
258
259 // Inverting signal if needed
260 if (first == 1) {
261 for (i = start; i < rawbit; i++) {
262 rawbits[i] = !rawbits[i];
263 }
264 }
265
266 // Dumping UID
267 uint8_t bits[224] = {0x00};
268 char showbits[225] = {0x00};
269 int bit;
270 i = start;
271 int times = 0;
272
273 if (uidlen > rawbit) {
274 PrintAndLog("Warning: not enough raw bits to get a full UID");
275 for (bit = 0; bit < rawbit; bit++) {
276 bits[bit] = rawbits[i++];
277 // As we cannot know the parity, let's use "." and "/"
278 showbits[bit] = '.' + bits[bit];
279 }
280 showbits[bit+1]='\0';
281 PrintAndLog("Partial UID=%s", showbits);
282 return 0;
283 } else {
284 for (bit = 0; bit < uidlen; bit++) {
285 bits[bit] = rawbits[i++];
286 showbits[bit] = '0' + bits[bit];
287 }
288 times = 1;
289 }
290
291 //convert UID to HEX
292 uint32_t uid1, uid2, uid3, uid4, uid5, uid6, uid7;
293 int idx;
294 uid1 = uid2 = 0;
295
296 if (uidlen==64){
297 for( idx=0; idx<64; idx++) {
298 if (showbits[idx] == '0') {
299 uid1=(uid1<<1)|(uid2>>31);
300 uid2=(uid2<<1)|0;
301 } else {
302 uid1=(uid1<<1)|(uid2>>31);
303 uid2=(uid2<<1)|1;
304 }
305 }
306 PrintAndLog("UID=%s (%x%08x)", showbits, uid1, uid2);
307 }
308 else {
309 uid3 = uid4 = uid5 = uid6 = uid7 = 0;
310
311 for( idx=0; idx<224; idx++) {
312 uid1=(uid1<<1)|(uid2>>31);
313 uid2=(uid2<<1)|(uid3>>31);
314 uid3=(uid3<<1)|(uid4>>31);
315 uid4=(uid4<<1)|(uid5>>31);
316 uid5=(uid5<<1)|(uid6>>31);
317 uid6=(uid6<<1)|(uid7>>31);
318
319 if (showbits[idx] == '0')
320 uid7 = (uid7<<1) | 0;
321 else
322 uid7 = (uid7<<1) | 1;
323 }
324 PrintAndLog("UID=%s (%x%08x%08x%08x%08x%08x%08x)", showbits, uid1, uid2, uid3, uid4, uid5, uid6, uid7);
325 }
326
327 // Checking UID against next occurrences
328 int failed = 0;
329 for (; i + uidlen <= rawbit;) {
330 failed = 0;
331 for (bit = 0; bit < uidlen; bit++) {
332 if (bits[bit] != rawbits[i++]) {
333 failed = 1;
334 break;
335 }
336 }
337 if (failed == 1) {
338 break;
339 }
340 times += 1;
341 }
342
343 PrintAndLog("Occurrences: %d (expected %d)", times, (rawbit - start) / uidlen);
344
345 // Remodulating for tag cloning
346 // HACK: 2015-01-04 this will have an impact on our new way of seening lf commands (demod)
347 // since this changes graphbuffer data.
348 GraphTraceLen = 32*uidlen;
349 i = 0;
350 int phase = 0;
351 for (bit = 0; bit < uidlen; bit++) {
352 if (bits[bit] == 0) {
353 phase = 0;
354 } else {
355 phase = 1;
356 }
357 int j;
358 for (j = 0; j < 32; j++) {
359 GraphBuffer[i++] = phase;
360 phase = !phase;
361 }
362 }
363
364 RepaintGraphWindow();
365 return 1;
366 }
367
368 int CmdIndalaClone(const char *Cmd)
369 {
370 UsbCommand c;
371 unsigned int uid1, uid2, uid3, uid4, uid5, uid6, uid7;
372
373 uid1 = uid2 = uid3 = uid4 = uid5 = uid6 = uid7 = 0;
374 int n = 0, i = 0;
375
376 if (strchr(Cmd,'l') != 0) {
377 while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
378 uid1 = (uid1 << 4) | (uid2 >> 28);
379 uid2 = (uid2 << 4) | (uid3 >> 28);
380 uid3 = (uid3 << 4) | (uid4 >> 28);
381 uid4 = (uid4 << 4) | (uid5 >> 28);
382 uid5 = (uid5 << 4) | (uid6 >> 28);
383 uid6 = (uid6 << 4) | (uid7 >> 28);
384 uid7 = (uid7 << 4) | (n & 0xf);
385 }
386 PrintAndLog("Cloning 224bit tag with UID %x%08x%08x%08x%08x%08x%08x", uid1, uid2, uid3, uid4, uid5, uid6, uid7);
387 c.cmd = CMD_INDALA_CLONE_TAG_L;
388 c.d.asDwords[0] = uid1;
389 c.d.asDwords[1] = uid2;
390 c.d.asDwords[2] = uid3;
391 c.d.asDwords[3] = uid4;
392 c.d.asDwords[4] = uid5;
393 c.d.asDwords[5] = uid6;
394 c.d.asDwords[6] = uid7;
395 } else {
396 while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
397 uid1 = (uid1 << 4) | (uid2 >> 28);
398 uid2 = (uid2 << 4) | (n & 0xf);
399 }
400 PrintAndLog("Cloning 64bit tag with UID %x%08x", uid1, uid2);
401 c.cmd = CMD_INDALA_CLONE_TAG;
402 c.arg[0] = uid1;
403 c.arg[1] = uid2;
404 }
405
406 SendCommand(&c);
407 return 0;
408 }
409
410 int usage_lf_read()
411 {
412 PrintAndLog("Usage: lf read");
413 PrintAndLog("Options: ");
414 PrintAndLog(" h This help");
415 PrintAndLog(" s silent run no printout");
416 PrintAndLog("This function takes no arguments. ");
417 PrintAndLog("Use 'lf config' to set parameters.");
418 return 0;
419 }
420 int usage_lf_snoop()
421 {
422 PrintAndLog("Usage: lf snoop");
423 PrintAndLog("Options: ");
424 PrintAndLog(" h This help");
425 PrintAndLog("This function takes no arguments. ");
426 PrintAndLog("Use 'lf config' to set parameters.");
427 return 0;
428 }
429
430 int usage_lf_config()
431 {
432 PrintAndLog("Usage: lf config [H|<divisor>] [b <bps>] [d <decim>] [a 0|1]");
433 PrintAndLog("Options: ");
434 PrintAndLog(" h This help");
435 PrintAndLog(" L Low frequency (125 KHz)");
436 PrintAndLog(" H High frequency (134 KHz)");
437 PrintAndLog(" q <divisor> Manually set divisor. 88-> 134KHz, 95-> 125 Hz");
438 PrintAndLog(" b <bps> Sets resolution of bits per sample. Default (max): 8");
439 PrintAndLog(" d <decim> Sets decimation. A value of N saves only 1 in N samples. Default: 1");
440 PrintAndLog(" a [0|1] Averaging - if set, will average the stored sample value when decimating. Default: 1");
441 PrintAndLog(" t <threshold> Sets trigger threshold. 0 means no threshold (range: 0-128)");
442 PrintAndLog("Examples:");
443 PrintAndLog(" lf config b 8 L");
444 PrintAndLog(" Samples at 125KHz, 8bps.");
445 PrintAndLog(" lf config H b 4 d 3");
446 PrintAndLog(" Samples at 134KHz, averages three samples into one, stored with ");
447 PrintAndLog(" a resolution of 4 bits per sample.");
448 PrintAndLog(" lf read");
449 PrintAndLog(" Performs a read (active field)");
450 PrintAndLog(" lf snoop");
451 PrintAndLog(" Performs a snoop (no active field)");
452 return 0;
453 }
454
455 int CmdLFSetConfig(const char *Cmd)
456 {
457
458 uint8_t divisor = 0;//Frequency divisor
459 uint8_t bps = 0; // Bits per sample
460 uint8_t decimation = 0; //How many to keep
461 bool averaging = 1; // Defaults to true
462 bool errors = FALSE;
463 int trigger_threshold =-1;//Means no change
464 uint8_t unsigned_trigg = 0;
465
466 uint8_t cmdp =0;
467 while(param_getchar(Cmd, cmdp) != 0x00)
468 {
469 switch(param_getchar(Cmd, cmdp))
470 {
471 case 'h':
472 return usage_lf_config();
473 case 'H':
474 divisor = 88;
475 cmdp++;
476 break;
477 case 'L':
478 divisor = 95;
479 cmdp++;
480 break;
481 case 'q':
482 errors |= param_getdec(Cmd,cmdp+1,&divisor);
483 cmdp+=2;
484 break;
485 case 't':
486 errors |= param_getdec(Cmd,cmdp+1,&unsigned_trigg);
487 cmdp+=2;
488 if(!errors) trigger_threshold = unsigned_trigg;
489 break;
490 case 'b':
491 errors |= param_getdec(Cmd,cmdp+1,&bps);
492 cmdp+=2;
493 break;
494 case 'd':
495 errors |= param_getdec(Cmd,cmdp+1,&decimation);
496 cmdp+=2;
497 break;
498 case 'a':
499 averaging = param_getchar(Cmd,cmdp+1) == '1';
500 cmdp+=2;
501 break;
502 default:
503 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
504 errors = 1;
505 break;
506 }
507 if(errors) break;
508 }
509 if(cmdp == 0)
510 {
511 errors = 1;// No args
512 }
513
514 //Validations
515 if(errors)
516 {
517 return usage_lf_config();
518 }
519 //Bps is limited to 8, so fits in lower half of arg1
520 if(bps >> 8) bps = 8;
521
522 sample_config config = {
523 decimation,bps,averaging,divisor,trigger_threshold
524 };
525 //Averaging is a flag on high-bit of arg[1]
526 UsbCommand c = {CMD_SET_LF_SAMPLING_CONFIG};
527 memcpy(c.d.asBytes,&config,sizeof(sample_config));
528 SendCommand(&c);
529 return 0;
530 }
531
532 int CmdLFRead(const char *Cmd)
533 {
534
535 uint8_t cmdp = 0;
536 bool arg1 = false;
537 if (param_getchar(Cmd, cmdp) == 'h')
538 {
539 return usage_lf_read();
540 }
541 if (param_getchar(Cmd, cmdp) == 's') arg1 = true; //suppress print
542 //And ship it to device
543 UsbCommand c = {CMD_ACQUIRE_RAW_ADC_SAMPLES_125K, {arg1,0,0}};
544 SendCommand(&c);
545 //WaitForResponse(CMD_ACK,NULL);
546 if ( !WaitForResponseTimeout(CMD_ACK,NULL,2500) ) {
547 PrintAndLog("command execution time out");
548 return 1;
549 }
550
551 return 0;
552 }
553
554 int CmdLFSnoop(const char *Cmd)
555 {
556 uint8_t cmdp =0;
557 if(param_getchar(Cmd, cmdp) == 'h')
558 {
559 return usage_lf_snoop();
560 }
561
562 UsbCommand c = {CMD_LF_SNOOP_RAW_ADC_SAMPLES};
563 SendCommand(&c);
564 WaitForResponse(CMD_ACK,NULL);
565 return 0;
566 }
567
568 static void ChkBitstream(const char *str)
569 {
570 int i;
571
572 /* convert to bitstream if necessary */
573 for (i = 0; i < (int)(GraphTraceLen / 2); i++){
574 if (GraphBuffer[i] > 1 || GraphBuffer[i] < 0) {
575 CmdGetBitStream("");
576 break;
577 }
578 }
579 }
580 //Attempt to simulate any wave in buffer (one bit per output sample)
581 // converts GraphBuffer to bitstream (based on zero crossings) if needed.
582 int CmdLFSim(const char *Cmd)
583 {
584 int i,j;
585 static int gap;
586
587 sscanf(Cmd, "%i", &gap);
588
589 // convert to bitstream if necessary
590
591 ChkBitstream(Cmd);
592
593 //can send only 512 bits at a time (1 byte sent per bit...)
594 printf("Sending [%d bytes]", GraphTraceLen);
595 for (i = 0; i < GraphTraceLen; i += USB_CMD_DATA_SIZE) {
596 UsbCommand c={CMD_DOWNLOADED_SIM_SAMPLES_125K, {i, 0, 0}};
597
598 for (j = 0; j < USB_CMD_DATA_SIZE; j++) {
599 c.d.asBytes[j] = GraphBuffer[i+j];
600 }
601 SendCommand(&c);
602 WaitForResponse(CMD_ACK,NULL);
603 printf(".");
604 }
605
606 printf("\n");
607 PrintAndLog("Starting to simulate");
608 UsbCommand c = {CMD_SIMULATE_TAG_125K, {GraphTraceLen, gap, 0}};
609 SendCommand(&c);
610 return 0;
611 }
612
613 int usage_lf_simfsk(void)
614 {
615 //print help
616 PrintAndLog("Usage: lf simfsk [c <clock>] [i] [H <fcHigh>] [L <fcLow>] [d <hexdata>]");
617 PrintAndLog("Options: ");
618 PrintAndLog(" h This help");
619 PrintAndLog(" c <clock> Manually set clock - can autodetect if using DemodBuffer");
620 PrintAndLog(" i invert data");
621 PrintAndLog(" H <fcHigh> Manually set the larger Field Clock");
622 PrintAndLog(" L <fcLow> Manually set the smaller Field Clock");
623 //PrintAndLog(" s TBD- -to enable a gap between playback repetitions - default: no gap");
624 PrintAndLog(" d <hexdata> Data to sim as hex - omit to sim from DemodBuffer");
625 PrintAndLog("\n NOTE: if you set one clock manually set them all manually");
626 return 0;
627 }
628
629 int usage_lf_simask(void)
630 {
631 //print help
632 PrintAndLog("Usage: lf simask [c <clock>] [i] [b|m|r] [s] [d <raw hex to sim>]");
633 PrintAndLog("Options: ");
634 PrintAndLog(" h This help");
635 PrintAndLog(" c <clock> Manually set clock - can autodetect if using DemodBuffer");
636 PrintAndLog(" i invert data");
637 PrintAndLog(" b sim ask/biphase");
638 PrintAndLog(" m sim ask/manchester - Default");
639 PrintAndLog(" r sim ask/raw");
640 PrintAndLog(" s TBD- -to enable a gap between playback repetitions - default: no gap");
641 PrintAndLog(" d <hexdata> Data to sim as hex - omit to sim from DemodBuffer");
642 return 0;
643 }
644
645 int usage_lf_simpsk(void)
646 {
647 //print help
648 PrintAndLog("Usage: lf simpsk [1|2|3] [c <clock>] [i] [r <carrier>] [d <raw hex to sim>]");
649 PrintAndLog("Options: ");
650 PrintAndLog(" h This help");
651 PrintAndLog(" c <clock> Manually set clock - can autodetect if using DemodBuffer");
652 PrintAndLog(" i invert data");
653 PrintAndLog(" 1 set PSK1 (default)");
654 PrintAndLog(" 2 set PSK2");
655 PrintAndLog(" 3 set PSK3");
656 PrintAndLog(" r <carrier> 2|4|8 are valid carriers: default = 2");
657 PrintAndLog(" d <hexdata> Data to sim as hex - omit to sim from DemodBuffer");
658 return 0;
659 }
660
661 // by marshmellow - sim ask data given clock, fcHigh, fcLow, invert
662 // - allow pull data from DemodBuffer
663 int CmdLFfskSim(const char *Cmd)
664 {
665 //might be able to autodetect FCs and clock from Graphbuffer if using demod buffer
666 // otherwise will need FChigh, FClow, Clock, and bitstream
667 uint8_t fcHigh=0, fcLow=0, clk=0;
668 uint8_t invert=0;
669 bool errors = FALSE;
670 char hexData[32] = {0x00}; // store entered hex data
671 uint8_t data[255] = {0x00};
672 int dataLen = 0;
673 uint8_t cmdp = 0;
674 while(param_getchar(Cmd, cmdp) != 0x00)
675 {
676 switch(param_getchar(Cmd, cmdp))
677 {
678 case 'h':
679 return usage_lf_simfsk();
680 case 'i':
681 invert = 1;
682 cmdp++;
683 break;
684 case 'c':
685 errors |= param_getdec(Cmd,cmdp+1,&clk);
686 cmdp+=2;
687 break;
688 case 'H':
689 errors |= param_getdec(Cmd,cmdp+1,&fcHigh);
690 cmdp+=2;
691 break;
692 case 'L':
693 errors |= param_getdec(Cmd,cmdp+1,&fcLow);
694 cmdp+=2;
695 break;
696 //case 's':
697 // separator=1;
698 // cmdp++;
699 // break;
700 case 'd':
701 dataLen = param_getstr(Cmd, cmdp+1, hexData);
702 if (dataLen==0) {
703 errors=TRUE;
704 } else {
705 dataLen = hextobinarray((char *)data, hexData);
706 }
707 if (dataLen==0) errors=TRUE;
708 if (errors) PrintAndLog ("Error getting hex data");
709 cmdp+=2;
710 break;
711 default:
712 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
713 errors = TRUE;
714 break;
715 }
716 if(errors) break;
717 }
718 if(cmdp == 0 && DemodBufferLen == 0)
719 {
720 errors = TRUE;// No args
721 }
722
723 //Validations
724 if(errors)
725 {
726 return usage_lf_simfsk();
727 }
728
729 if (dataLen == 0){ //using DemodBuffer
730 if (clk==0 || fcHigh==0 || fcLow==0){ //manual settings must set them all
731 uint8_t ans = fskClocks(&fcHigh, &fcLow, &clk, 0);
732 if (ans==0){
733 if (!fcHigh) fcHigh=10;
734 if (!fcLow) fcLow=8;
735 if (!clk) clk=50;
736 }
737 }
738 } else {
739 setDemodBuf(data, dataLen, 0);
740 }
741
742 //default if not found
743 if (clk == 0) clk = 50;
744 if (fcHigh == 0) fcHigh = 10;
745 if (fcLow == 0) fcLow = 8;
746
747 uint16_t arg1, arg2;
748 arg1 = fcHigh << 8 | fcLow;
749 arg2 = invert << 8 | clk;
750 size_t size = DemodBufferLen;
751 if (size > USB_CMD_DATA_SIZE) {
752 PrintAndLog("DemodBuffer too long for current implementation - length: %d - max: %d", size, USB_CMD_DATA_SIZE);
753 size = USB_CMD_DATA_SIZE;
754 }
755 UsbCommand c = {CMD_FSK_SIM_TAG, {arg1, arg2, size}};
756
757 memcpy(c.d.asBytes, DemodBuffer, size);
758 SendCommand(&c);
759 return 0;
760 }
761
762 // by marshmellow - sim ask data given clock, invert, manchester or raw, separator
763 // - allow pull data from DemodBuffer
764 int CmdLFaskSim(const char *Cmd)
765 {
766 //autodetect clock from Graphbuffer if using demod buffer
767 // needs clock, invert, manchester/raw as m or r, separator as s, and bitstream
768 uint8_t encoding = 1, separator = 0;
769 uint8_t clk=0, invert=0;
770 bool errors = FALSE;
771 char hexData[32] = {0x00};
772 uint8_t data[255]= {0x00}; // store entered hex data
773 int dataLen = 0;
774 uint8_t cmdp = 0;
775 while(param_getchar(Cmd, cmdp) != 0x00)
776 {
777 switch(param_getchar(Cmd, cmdp))
778 {
779 case 'h':
780 return usage_lf_simask();
781 case 'i':
782 invert = 1;
783 cmdp++;
784 break;
785 case 'c':
786 errors |= param_getdec(Cmd,cmdp+1,&clk);
787 cmdp+=2;
788 break;
789 case 'b':
790 encoding=2; //biphase
791 cmdp++;
792 break;
793 case 'm':
794 encoding=1;
795 cmdp++;
796 break;
797 case 'r':
798 encoding=0;
799 cmdp++;
800 break;
801 case 's':
802 separator=1;
803 cmdp++;
804 break;
805 case 'd':
806 dataLen = param_getstr(Cmd, cmdp+1, hexData);
807 if (dataLen==0) {
808 errors=TRUE;
809 } else {
810 dataLen = hextobinarray((char *)data, hexData);
811 }
812 if (dataLen==0) errors=TRUE;
813 if (errors) PrintAndLog ("Error getting hex data, datalen: %d",dataLen);
814 cmdp+=2;
815 break;
816 default:
817 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
818 errors = TRUE;
819 break;
820 }
821 if(errors) break;
822 }
823 if(cmdp == 0 && DemodBufferLen == 0)
824 {
825 errors = TRUE;// No args
826 }
827
828 //Validations
829 if(errors)
830 {
831 return usage_lf_simask();
832 }
833 if (dataLen == 0){ //using DemodBuffer
834 if (clk == 0) clk = GetAskClock("0", false, false);
835 } else {
836 setDemodBuf(data, dataLen, 0);
837 }
838 if (clk == 0) clk = 64;
839 if (encoding == 0) clk = clk/2; //askraw needs to double the clock speed
840 uint16_t arg1, arg2;
841 size_t size=DemodBufferLen;
842 arg1 = clk << 8 | encoding;
843 arg2 = invert << 8 | separator;
844 if (size > USB_CMD_DATA_SIZE) {
845 PrintAndLog("DemodBuffer too long for current implementation - length: %d - max: %d", size, USB_CMD_DATA_SIZE);
846 size = USB_CMD_DATA_SIZE;
847 }
848 UsbCommand c = {CMD_ASK_SIM_TAG, {arg1, arg2, size}};
849 PrintAndLog("preparing to sim ask data: %d bits", size);
850 memcpy(c.d.asBytes, DemodBuffer, size);
851 SendCommand(&c);
852 return 0;
853 }
854
855 // by marshmellow - sim psk data given carrier, clock, invert
856 // - allow pull data from DemodBuffer or parameters
857 int CmdLFpskSim(const char *Cmd)
858 {
859 //might be able to autodetect FC and clock from Graphbuffer if using demod buffer
860 //will need carrier, Clock, and bitstream
861 uint8_t carrier=0, clk=0;
862 uint8_t invert=0;
863 bool errors = FALSE;
864 char hexData[32] = {0x00}; // store entered hex data
865 uint8_t data[255] = {0x00};
866 int dataLen = 0;
867 uint8_t cmdp = 0;
868 uint8_t pskType = 1;
869 while(param_getchar(Cmd, cmdp) != 0x00)
870 {
871 switch(param_getchar(Cmd, cmdp))
872 {
873 case 'h':
874 return usage_lf_simpsk();
875 case 'i':
876 invert = 1;
877 cmdp++;
878 break;
879 case 'c':
880 errors |= param_getdec(Cmd,cmdp+1,&clk);
881 cmdp+=2;
882 break;
883 case 'r':
884 errors |= param_getdec(Cmd,cmdp+1,&carrier);
885 cmdp+=2;
886 break;
887 case '1':
888 pskType=1;
889 cmdp++;
890 break;
891 case '2':
892 pskType=2;
893 cmdp++;
894 break;
895 case '3':
896 pskType=3;
897 cmdp++;
898 break;
899 case 'd':
900 dataLen = param_getstr(Cmd, cmdp+1, hexData);
901 if (dataLen==0) {
902 errors=TRUE;
903 } else {
904 dataLen = hextobinarray((char *)data, hexData);
905 }
906 if (dataLen==0) errors=TRUE;
907 if (errors) PrintAndLog ("Error getting hex data");
908 cmdp+=2;
909 break;
910 default:
911 PrintAndLog("Unknown parameter '%c'", param_getchar(Cmd, cmdp));
912 errors = TRUE;
913 break;
914 }
915 if (errors) break;
916 }
917 if (cmdp == 0 && DemodBufferLen == 0)
918 {
919 errors = TRUE;// No args
920 }
921
922 //Validations
923 if (errors)
924 {
925 return usage_lf_simpsk();
926 }
927 if (dataLen == 0){ //using DemodBuffer
928 PrintAndLog("Getting Clocks");
929 if (clk==0) clk = GetPskClock("", FALSE, FALSE);
930 PrintAndLog("clk: %d",clk);
931 if (!carrier) carrier = GetPskCarrier("", FALSE, FALSE);
932 PrintAndLog("carrier: %d", carrier);
933 } else {
934 setDemodBuf(data, dataLen, 0);
935 }
936
937 if (clk <= 0) clk = 32;
938 if (carrier == 0) carrier = 2;
939 if (pskType != 1){
940 if (pskType == 2){
941 //need to convert psk2 to psk1 data before sim
942 psk2TOpsk1(DemodBuffer, DemodBufferLen);
943 } else {
944 PrintAndLog("Sorry, PSK3 not yet available");
945 }
946 }
947 uint16_t arg1, arg2;
948 arg1 = clk << 8 | carrier;
949 arg2 = invert;
950 size_t size=DemodBufferLen;
951 if (size > USB_CMD_DATA_SIZE) {
952 PrintAndLog("DemodBuffer too long for current implementation - length: %d - max: %d", size, USB_CMD_DATA_SIZE);
953 size=USB_CMD_DATA_SIZE;
954 }
955 UsbCommand c = {CMD_PSK_SIM_TAG, {arg1, arg2, size}};
956 PrintAndLog("DEBUG: Sending DemodBuffer Length: %d", size);
957 memcpy(c.d.asBytes, DemodBuffer, size);
958 SendCommand(&c);
959
960 return 0;
961 }
962
963 int CmdLFSimBidir(const char *Cmd)
964 {
965 // Set ADC to twice the carrier for a slight supersampling
966 // HACK: not implemented in ARMSRC.
967 PrintAndLog("Not implemented yet.");
968 UsbCommand c = {CMD_LF_SIMULATE_BIDIR, {47, 384, 0}};
969 SendCommand(&c);
970 return 0;
971 }
972
973 int CmdVchDemod(const char *Cmd)
974 {
975 // Is this the entire sync pattern, or does this also include some
976 // data bits that happen to be the same everywhere? That would be
977 // lovely to know.
978 static const int SyncPattern[] = {
979 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
980 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
981 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
982 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
983 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
984 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
985 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
986 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
987 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
988 1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
989 };
990
991 // So first, we correlate for the sync pattern, and mark that.
992 int bestCorrel = 0, bestPos = 0;
993 int i;
994 // It does us no good to find the sync pattern, with fewer than
995 // 2048 samples after it...
996 for (i = 0; i < (GraphTraceLen-2048); i++) {
997 int sum = 0;
998 int j;
999 for (j = 0; j < arraylen(SyncPattern); j++) {
1000 sum += GraphBuffer[i+j]*SyncPattern[j];
1001 }
1002 if (sum > bestCorrel) {
1003 bestCorrel = sum;
1004 bestPos = i;
1005 }
1006 }
1007 PrintAndLog("best sync at %d [metric %d]", bestPos, bestCorrel);
1008
1009 char bits[257];
1010 bits[256] = '\0';
1011
1012 int worst = INT_MAX;
1013 int worstPos = 0;
1014
1015 for (i = 0; i < 2048; i += 8) {
1016 int sum = 0;
1017 int j;
1018 for (j = 0; j < 8; j++) {
1019 sum += GraphBuffer[bestPos+i+j];
1020 }
1021 if (sum < 0) {
1022 bits[i/8] = '.';
1023 } else {
1024 bits[i/8] = '1';
1025 }
1026 if(abs(sum) < worst) {
1027 worst = abs(sum);
1028 worstPos = i;
1029 }
1030 }
1031 PrintAndLog("bits:");
1032 PrintAndLog("%s", bits);
1033 PrintAndLog("worst metric: %d at pos %d", worst, worstPos);
1034
1035 if (strcmp(Cmd, "clone")==0) {
1036 GraphTraceLen = 0;
1037 char *s;
1038 for(s = bits; *s; s++) {
1039 int j;
1040 for(j = 0; j < 16; j++) {
1041 GraphBuffer[GraphTraceLen++] = (*s == '1') ? 1 : 0;
1042 }
1043 }
1044 RepaintGraphWindow();
1045 }
1046 return 0;
1047 }
1048
1049 //by marshmellow
1050 int CmdLFfind(const char *Cmd)
1051 {
1052 int ans=0;
1053 char cmdp = param_getchar(Cmd, 0);
1054 char testRaw = param_getchar(Cmd, 1);
1055 if (strlen(Cmd) > 3 || cmdp == 'h' || cmdp == 'H') {
1056 PrintAndLog("Usage: lf search <0|1> [u]");
1057 PrintAndLog(" <use data from Graphbuffer> , if not set, try reading data from tag.");
1058 PrintAndLog(" [Search for Unknown tags] , if not set, reads only known tags.");
1059 PrintAndLog("");
1060 PrintAndLog(" sample: lf search = try reading data from tag & search for known tags");
1061 PrintAndLog(" : lf search 1 = use data from GraphBuffer & search for known tags");
1062 PrintAndLog(" : lf search u = try reading data from tag & search for known and unknown tags");
1063 PrintAndLog(" : lf search 1 u = use data from GraphBuffer & search for known and unknown tags");
1064
1065 return 0;
1066 }
1067
1068 if (!offline && (cmdp != '1')){
1069 CmdLFRead("s");
1070 getSamples("30000",false);
1071 } else if (GraphTraceLen < 1000) {
1072 PrintAndLog("Data in Graphbuffer was too small.");
1073 return 0;
1074 }
1075 if (cmdp == 'u' || cmdp == 'U') testRaw = 'u';
1076
1077 PrintAndLog("NOTE: some demods output possible binary\n if it finds something that looks like a tag");
1078 PrintAndLog("False Positives ARE possible\n");
1079 PrintAndLog("\nChecking for known tags:\n");
1080
1081 ans=CmdFSKdemodIO("");
1082 if (ans>0) {
1083 PrintAndLog("\nValid IO Prox ID Found!");
1084 return 1;
1085 }
1086
1087 ans=CmdFSKdemodPyramid("");
1088 if (ans>0) {
1089 PrintAndLog("\nValid Pyramid ID Found!");
1090 return 1;
1091 }
1092
1093 ans=CmdFSKdemodParadox("");
1094 if (ans>0) {
1095 PrintAndLog("\nValid Paradox ID Found!");
1096 return 1;
1097 }
1098
1099 ans=CmdFSKdemodAWID("");
1100 if (ans>0) {
1101 PrintAndLog("\nValid AWID ID Found!");
1102 return 1;
1103 }
1104
1105 ans=CmdFSKdemodHID("");
1106 if (ans>0) {
1107 PrintAndLog("\nValid HID Prox ID Found!");
1108 return 1;
1109 }
1110
1111 //add psk and indala
1112 ans=CmdIndalaDecode("");
1113 if (ans>0) {
1114 PrintAndLog("\nValid Indala ID Found!");
1115 return 1;
1116 }
1117
1118 ans=CmdAskEM410xDemod("");
1119 if (ans>0) {
1120 PrintAndLog("\nValid EM410x ID Found!");
1121 return 1;
1122 }
1123
1124 ans=CmdG_Prox_II_Demod("");
1125 if (ans>0) {
1126 PrintAndLog("\nValid Guardall G-Prox II ID Found!");
1127 return 1;
1128 }
1129
1130 ans=CmdFDXBdemodBI("");
1131 if (ans>0) {
1132 PrintAndLog("\nValid FDX-B ID Found!");
1133 return 1;
1134 }
1135
1136 ans=EM4x50Read("", false);
1137 if (ans>0) {
1138 PrintAndLog("\nValid EM4x50 ID Found!");
1139 return 1;
1140 }
1141
1142 ans=CmdPSKNexWatch("");
1143 if (ans>0) {
1144 PrintAndLog("\nValid NexWatch ID Found!");
1145 return 1;
1146 }
1147
1148 PrintAndLog("\nNo Known Tags Found!\n");
1149 if (testRaw=='u' || testRaw=='U'){
1150 //test unknown tag formats (raw mode)
1151 PrintAndLog("\nChecking for Unknown tags:\n");
1152 ans=AutoCorrelate(4000, FALSE, FALSE);
1153
1154 if (ans > 0) {
1155
1156 PrintAndLog("Possible Auto Correlation of %d repeating samples",ans);
1157
1158 if ( ans % 8 == 0) {
1159 int bytes = (ans / 8);
1160 PrintAndLog("Possible %d bytes", bytes);
1161 int blocks = 0;
1162 if ( bytes % 2 == 0) {
1163 blocks = (bytes / 2);
1164 PrintAndLog("Possible 2 blocks, width %d", blocks);
1165 }
1166 if ( bytes % 4 == 0) {
1167 blocks = (bytes / 4);
1168 PrintAndLog("Possible 4 blocks, width %d", blocks);
1169 }
1170 if ( bytes % 8 == 0) {
1171 blocks = (bytes / 8);
1172 PrintAndLog("Possible 8 blocks, width %d", blocks);
1173 }
1174 if ( bytes % 16 == 0) {
1175 blocks = (bytes / 16);
1176 PrintAndLog("Possible 16 blocks, width %d", blocks);
1177 }
1178 }
1179 }
1180 ans=GetFskClock("",FALSE,FALSE);
1181 if (ans != 0){ //fsk
1182 ans=FSKrawDemod("",TRUE);
1183 if (ans>0) {
1184 PrintAndLog("\nUnknown FSK Modulated Tag Found!");
1185 return 1;
1186 }
1187 }
1188 ans=ASKDemod("0 0 0",TRUE,FALSE,1);
1189 if (ans>0) {
1190 PrintAndLog("\nUnknown ASK Modulated and Manchester encoded Tag Found!");
1191 PrintAndLog("\nif it does not look right it could instead be ASK/Biphase - try 'data rawdemod ab'");
1192 return 1;
1193 }
1194 ans=CmdPSK1rawDemod("");
1195 if (ans>0) {
1196 PrintAndLog("Possible unknown PSK1 Modulated Tag Found above!\n\nCould also be PSK2 - try 'data rawdemod p2'");
1197 PrintAndLog("\nCould also be PSK3 - [currently not supported]");
1198 PrintAndLog("\nCould also be NRZ - try 'data nrzrawdemod");
1199 return 1;
1200 }
1201 PrintAndLog("\nNo Data Found!\n");
1202 }
1203 return 0;
1204 }
1205
1206 static command_t CommandTable[] =
1207 {
1208 {"help", CmdHelp, 1, "This help"},
1209 {"em4x", CmdLFEM4X, 1, "{ EM4X RFIDs... }"},
1210 {"awid", CmdLFAWID, 1, "{ AWID RFIDs... }"},
1211 {"hid", CmdLFHID, 1, "{ HID RFIDs... }"},
1212 {"hitag", CmdLFHitag, 1, "{ HITAG RFIDs... }"},
1213 {"io", CmdLFIO, 1, "{ IOPROX RFIDs... }"},
1214 {"pcf7931", CmdLFPCF7931, 1, "{ PCF7931 RFIDs... }"},
1215 {"ti", CmdLFTI, 1, "{ TI RFIDs... }"},
1216 {"t55xx", CmdLFT55XX, 1, "{ T55X7 RFIDs... }"},
1217 {"viking", CmdLFViking, 1, "{ Viking RFIDs... }"},
1218 {"config", CmdLFSetConfig, 0, "Set config for LF sampling, bit/sample, decimation, frequency"},
1219
1220 {"cmdread", CmdLFCommandRead, 0, "<off period> <'0' period> <'1' period> <command> ['h' 134] \n\t\t-- Modulate LF reader field to send command before read (all periods in microseconds)"},
1221 {"flexdemod", CmdFlexdemod, 1, "Demodulate samples for FlexPass"},
1222 {"indalademod", CmdIndalaDemod, 1, "['224'] -- Demodulate samples for Indala 64 bit UID (option '224' for 224 bit)"},
1223 {"indalaclone", CmdIndalaClone, 0, "<UID> ['l']-- Clone Indala to T55x7 (tag must be in antenna)(UID in HEX)(option 'l' for 224 UID"},
1224 {"read", CmdLFRead, 0, "['s' silent] Read 125/134 kHz LF ID-only tag. Do 'lf read h' for help"},
1225 {"search", CmdLFfind, 1, "[offline] ['u'] Read and Search for valid known tag (in offline mode it you can load first then search) \n\t\t-- 'u' to search for unknown tags"},
1226 {"sim", CmdLFSim, 0, "[GAP] -- Simulate LF tag from buffer with optional GAP (in microseconds)"},
1227 {"simask", CmdLFaskSim, 0, "[clock] [invert <1|0>] [biphase/manchester/raw <'b'|'m'|'r'>] [msg separator 's'] [d <hexdata>] \n\t\t-- Simulate LF ASK tag from demodbuffer or input"},
1228 {"simfsk", CmdLFfskSim, 0, "[c <clock>] [i] [H <fcHigh>] [L <fcLow>] [d <hexdata>] \n\t\t-- Simulate LF FSK tag from demodbuffer or input"},
1229 {"simpsk", CmdLFpskSim, 0, "[1|2|3] [c <clock>] [i] [r <carrier>] [d <raw hex to sim>] \n\t\t-- Simulate LF PSK tag from demodbuffer or input"},
1230 {"simbidir", CmdLFSimBidir, 0, "Simulate LF tag (with bidirectional data transmission between reader and tag)"},
1231 {"snoop", CmdLFSnoop, 0, "['l'|'h'|<divisor>] [trigger threshold] -- Snoop LF (l:125khz, h:134khz)"},
1232 {"vchdemod", CmdVchDemod, 1, "['clone'] -- Demodulate samples for VeriChip"},
1233 {NULL, NULL, 0, NULL}
1234 };
1235
1236 int CmdLF(const char *Cmd)
1237 {
1238 CmdsParse(CommandTable, Cmd);
1239 return 0;
1240 }
1241
1242 int CmdHelp(const char *Cmd)
1243 {
1244 CmdsHelp(CommandTable);
1245 return 0;
1246 }
Proxmark3 GIT tracking
Impressum, Datenschutz