]> cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdlfem4x.c
e45c788aad82a3ba5e64821bc0cb738ab7391c45
[proxmark3-svn] / client / cmdlfem4x.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // Low frequency EM4x commands
9 //-----------------------------------------------------------------------------
10
11 #include <stdio.h>
12 #include <string.h>
13 #include <inttypes.h>
14 #include "proxmark3.h"
15 #include "ui.h"
16 #include "util.h"
17 #include "graph.h"
18 #include "cmdparser.h"
19 #include "cmddata.h"
20 #include "cmdlf.h"
21 #include "cmdlfem4x.h"
22 #include "lfdemod.h"
23 char *global_em410xId;
24
25 static int CmdHelp(const char *Cmd);
26
27 int CmdEMdemodASK(const char *Cmd)
28 {
29 char cmdp = param_getchar(Cmd, 0);
30 int findone = (cmdp == '1') ? 1 : 0;
31 UsbCommand c={CMD_EM410X_DEMOD};
32 c.arg[0]=findone;
33 SendCommand(&c);
34 return 0;
35 }
36
37 /* Read the ID of an EM410x tag.
38 * Format:
39 * 1111 1111 1 <-- standard non-repeatable header
40 * XXXX [row parity bit] <-- 10 rows of 5 bits for our 40 bit tag ID
41 * ....
42 * CCCC <-- each bit here is parity for the 10 bits above in corresponding column
43 * 0 <-- stop bit, end of tag
44 */
45 int CmdEM410xRead(const char *Cmd)
46 {
47 uint32_t hi=0;
48 uint64_t lo=0;
49
50 if(!AskEm410xDemod("", &hi, &lo)) return 0;
51 PrintAndLog("EM410x pattern found: ");
52 printEM410x(hi, lo);
53 if (hi){
54 PrintAndLog ("EM410x XL pattern found");
55 return 0;
56 }
57 char id[12] = {0x00};
58 sprintf(id, "%010llx",lo);
59
60 global_em410xId = id;
61 return 1;
62 }
63
64 // emulate an EM410X tag
65 int CmdEM410xSim(const char *Cmd)
66 {
67 int i, n, j, binary[4], parity[4];
68
69 char cmdp = param_getchar(Cmd, 0);
70 uint8_t uid[5] = {0x00};
71
72 if (cmdp == 'h' || cmdp == 'H') {
73 PrintAndLog("Usage: lf em4x 410xsim <UID>");
74 PrintAndLog("");
75 PrintAndLog(" sample: lf em4x 410xsim 0F0368568B");
76 return 0;
77 }
78
79 if (param_gethex(Cmd, 0, uid, 10)) {
80 PrintAndLog("UID must include 10 HEX symbols");
81 return 0;
82 }
83
84 PrintAndLog("Starting simulating UID %02X%02X%02X%02X%02X", uid[0],uid[1],uid[2],uid[3],uid[4]);
85 PrintAndLog("Press pm3-button to about simulation");
86
87 /* clock is 64 in EM410x tags */
88 int clock = 64;
89
90 /* clear our graph */
91 ClearGraph(0);
92
93 /* write 9 start bits */
94 for (i = 0; i < 9; i++)
95 AppendGraph(0, clock, 1);
96
97 /* for each hex char */
98 parity[0] = parity[1] = parity[2] = parity[3] = 0;
99 for (i = 0; i < 10; i++)
100 {
101 /* read each hex char */
102 sscanf(&Cmd[i], "%1x", &n);
103 for (j = 3; j >= 0; j--, n/= 2)
104 binary[j] = n % 2;
105
106 /* append each bit */
107 AppendGraph(0, clock, binary[0]);
108 AppendGraph(0, clock, binary[1]);
109 AppendGraph(0, clock, binary[2]);
110 AppendGraph(0, clock, binary[3]);
111
112 /* append parity bit */
113 AppendGraph(0, clock, binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
114
115 /* keep track of column parity */
116 parity[0] ^= binary[0];
117 parity[1] ^= binary[1];
118 parity[2] ^= binary[2];
119 parity[3] ^= binary[3];
120 }
121
122 /* parity columns */
123 AppendGraph(0, clock, parity[0]);
124 AppendGraph(0, clock, parity[1]);
125 AppendGraph(0, clock, parity[2]);
126 AppendGraph(0, clock, parity[3]);
127
128 /* stop bit */
129 AppendGraph(1, clock, 0);
130
131 CmdLFSim("0"); //240 start_gap.
132 return 0;
133 }
134
135 /* Function is equivalent of lf read + data samples + em410xread
136 * looped until an EM410x tag is detected
137 *
138 * Why is CmdSamples("16000")?
139 * TBD: Auto-grow sample size based on detected sample rate. IE: If the
140 * rate gets lower, then grow the number of samples
141 * Changed by martin, 4000 x 4 = 16000,
142 * see http://www.proxmark.org/forum/viewtopic.php?pid=7235#p7235
143 */
144 int CmdEM410xWatch(const char *Cmd)
145 {
146 do {
147 if (ukbhit()) {
148 printf("\naborted via keyboard!\n");
149 break;
150 }
151
152 CmdLFRead("s");
153 getSamples("8201",true); //capture enough to get 2 complete preambles (4096*2+9)
154 } while (!CmdEM410xRead(""));
155
156 return 0;
157 }
158
159 //currently only supports manchester modulations
160 int CmdEM410xWatchnSpoof(const char *Cmd)
161 {
162 CmdEM410xWatch(Cmd);
163 PrintAndLog("# Replaying captured ID: %s",global_em410xId);
164 CmdLFaskSim("");
165 return 0;
166 }
167
168 int CmdEM410xWrite(const char *Cmd)
169 {
170 uint64_t id = 0xFFFFFFFFFFFFFFFF; // invalid id value
171 int card = 0xFF; // invalid card value
172 unsigned int clock = 0; // invalid clock value
173
174 sscanf(Cmd, "%" PRIx64 " %d %d", &id, &card, &clock);
175
176 // Check ID
177 if (id == 0xFFFFFFFFFFFFFFFF) {
178 PrintAndLog("Error! ID is required.\n");
179 return 0;
180 }
181 if (id >= 0x10000000000) {
182 PrintAndLog("Error! Given EM410x ID is longer than 40 bits.\n");
183 return 0;
184 }
185
186 // Check Card
187 if (card == 0xFF) {
188 PrintAndLog("Error! Card type required.\n");
189 return 0;
190 }
191 if (card < 0) {
192 PrintAndLog("Error! Bad card type selected.\n");
193 return 0;
194 }
195
196 // Check Clock
197 if (card == 1)
198 {
199 // Default: 64
200 if (clock == 0)
201 clock = 64;
202
203 // Allowed clock rates: 16, 32 and 64
204 if ((clock != 16) && (clock != 32) && (clock != 64)) {
205 PrintAndLog("Error! Clock rate %d not valid. Supported clock rates are 16, 32 and 64.\n", clock);
206 return 0;
207 }
208 }
209 else if (clock != 0)
210 {
211 PrintAndLog("Error! Clock rate is only supported on T55x7 tags.\n");
212 return 0;
213 }
214
215 if (card == 1) {
216 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64 " (clock rate: %d)", "T55x7", id, clock);
217 // NOTE: We really should pass the clock in as a separate argument, but to
218 // provide for backwards-compatibility for older firmware, and to avoid
219 // having to add another argument to CMD_EM410X_WRITE_TAG, we just store
220 // the clock rate in bits 8-15 of the card value
221 card = (card & 0xFF) | (((uint64_t)clock << 8) & 0xFF00);
222 }
223 else if (card == 0)
224 PrintAndLog("Writing %s tag with UID 0x%010" PRIx64, "T5555", id, clock);
225 else {
226 PrintAndLog("Error! Bad card type selected.\n");
227 return 0;
228 }
229
230 UsbCommand c = {CMD_EM410X_WRITE_TAG, {card, (uint32_t)(id >> 32), (uint32_t)id}};
231 SendCommand(&c);
232
233 return 0;
234 }
235
236 bool EM_EndParityTest(uint8_t *BitStream, size_t size, uint8_t rows, uint8_t cols, uint8_t pType)
237 {
238 if (rows*cols>size) return false;
239 uint8_t colP=0;
240 //assume last col is a parity and do not test
241 for (uint8_t colNum = 0; colNum < cols-1; colNum++) {
242 for (uint8_t rowNum = 0; rowNum < rows; rowNum++) {
243 colP ^= BitStream[(rowNum*cols)+colNum];
244 }
245 if (colP != pType) return false;
246 }
247 return true;
248 }
249
250 bool EM_ByteParityTest(uint8_t *BitStream, size_t size, uint8_t rows, uint8_t cols, uint8_t pType)
251 {
252 if (rows*cols>size) return false;
253 uint8_t rowP=0;
254 //assume last row is a parity row and do not test
255 for (uint8_t rowNum = 0; rowNum < rows-1; rowNum++) {
256 for (uint8_t colNum = 0; colNum < cols; colNum++) {
257 rowP ^= BitStream[(rowNum*cols)+colNum];
258 }
259 if (rowP != pType) return false;
260 }
261 return true;
262 }
263
264 uint32_t OutputEM4x50_Block(uint8_t *BitStream, size_t size, bool verbose, bool pTest)
265 {
266 if (size<45) return 0;
267 uint32_t code = bytebits_to_byte(BitStream,8);
268 code = code<<8 | bytebits_to_byte(BitStream+9,8);
269 code = code<<8 | bytebits_to_byte(BitStream+18,8);
270 code = code<<8 | bytebits_to_byte(BitStream+27,8);
271 if (verbose || g_debugMode){
272 for (uint8_t i = 0; i<5; i++){
273 if (i == 4) PrintAndLog(""); //parity byte spacer
274 PrintAndLog("%d%d%d%d%d%d%d%d %d -> 0x%02x",
275 BitStream[i*9],
276 BitStream[i*9+1],
277 BitStream[i*9+2],
278 BitStream[i*9+3],
279 BitStream[i*9+4],
280 BitStream[i*9+5],
281 BitStream[i*9+6],
282 BitStream[i*9+7],
283 BitStream[i*9+8],
284 bytebits_to_byte(BitStream+i*9,8)
285 );
286 }
287 if (pTest)
288 PrintAndLog("Parity Passed");
289 else
290 PrintAndLog("Parity Failed");
291 }
292 return code;
293 }
294 /* Read the transmitted data of an EM4x50 tag
295 * Format:
296 *
297 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
298 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
299 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
300 * XXXXXXXX [row parity bit (even)] <- 8 bits plus parity
301 * CCCCCCCC <- column parity bits
302 * 0 <- stop bit
303 * LW <- Listen Window
304 *
305 * This pattern repeats for every block of data being transmitted.
306 * Transmission starts with two Listen Windows (LW - a modulated
307 * pattern of 320 cycles each (32/32/128/64/64)).
308 *
309 * Note that this data may or may not be the UID. It is whatever data
310 * is stored in the blocks defined in the control word First and Last
311 * Word Read values. UID is stored in block 32.
312 */
313 //completed by Marshmellow
314 int EM4x50Read(const char *Cmd, bool verbose)
315 {
316 uint8_t fndClk[] = {8,16,32,40,50,64,128};
317 int clk = 0;
318 int invert = 0;
319 int tol = 0;
320 int i, j, startblock, skip, block, start, end, low, high, minClk;
321 bool complete = false;
322 int tmpbuff[MAX_GRAPH_TRACE_LEN / 64];
323 uint32_t Code[6];
324 char tmp[6];
325 char tmp2[20];
326 high = low = 0;
327 memset(tmpbuff, 0, MAX_GRAPH_TRACE_LEN / 64);
328
329 // get user entry if any
330 sscanf(Cmd, "%i %i", &clk, &invert);
331
332 // save GraphBuffer - to restore it later
333 save_restoreGB(1);
334
335 // first get high and low values
336 for (i = 0; i < GraphTraceLen; i++) {
337 if (GraphBuffer[i] > high)
338 high = GraphBuffer[i];
339 else if (GraphBuffer[i] < low)
340 low = GraphBuffer[i];
341 }
342
343 i = 0;
344 j = 0;
345 minClk = 255;
346 // get to first full low to prime loop and skip incomplete first pulse
347 while ((GraphBuffer[i] < high) && (i < GraphTraceLen))
348 ++i;
349 while ((GraphBuffer[i] > low) && (i < GraphTraceLen))
350 ++i;
351 skip = i;
352
353 // populate tmpbuff buffer with pulse lengths
354 while (i < GraphTraceLen) {
355 // measure from low to low
356 while ((GraphBuffer[i] > low) && (i < GraphTraceLen))
357 ++i;
358 start= i;
359 while ((GraphBuffer[i] < high) && (i < GraphTraceLen))
360 ++i;
361 while ((GraphBuffer[i] > low) && (i < GraphTraceLen))
362 ++i;
363 if (j>=(MAX_GRAPH_TRACE_LEN/64)) {
364 break;
365 }
366 tmpbuff[j++]= i - start;
367 if (i-start < minClk && i < GraphTraceLen) {
368 minClk = i - start;
369 }
370 }
371 // set clock
372 if (!clk) {
373 for (uint8_t clkCnt = 0; clkCnt<7; clkCnt++) {
374 tol = fndClk[clkCnt]/8;
375 if (minClk >= fndClk[clkCnt]-tol && minClk <= fndClk[clkCnt]+1) {
376 clk=fndClk[clkCnt];
377 break;
378 }
379 }
380 if (!clk) return 0;
381 } else tol = clk/8;
382
383 // look for data start - should be 2 pairs of LW (pulses of clk*3,clk*2)
384 start = -1;
385 for (i= 0; i < j - 4 ; ++i) {
386 skip += tmpbuff[i];
387 if (tmpbuff[i] >= clk*3-tol && tmpbuff[i] <= clk*3+tol) //3 clocks
388 if (tmpbuff[i+1] >= clk*2-tol && tmpbuff[i+1] <= clk*2+tol) //2 clocks
389 if (tmpbuff[i+2] >= clk*3-tol && tmpbuff[i+2] <= clk*3+tol) //3 clocks
390 if (tmpbuff[i+3] >= clk-tol) //1.5 to 2 clocks - depends on bit following
391 {
392 start= i + 4;
393 break;
394 }
395 }
396 startblock = i + 4;
397
398 // skip over the remainder of LW
399 skip += tmpbuff[i+1] + tmpbuff[i+2] + clk + clk/8;
400 int phaseoff = tmpbuff[i+3]-clk;
401
402 // now do it again to find the end
403 end = skip;
404 for (i += 3; i < j - 4 ; ++i) {
405 end += tmpbuff[i];
406 if (tmpbuff[i] >= clk*3-tol && tmpbuff[i] <= clk*3+tol) //3 clocks
407 if (tmpbuff[i+1] >= clk*2-tol && tmpbuff[i+1] <= clk*2+tol) //2 clocks
408 if (tmpbuff[i+2] >= clk*3-tol && tmpbuff[i+2] <= clk*3+tol) //3 clocks
409 if (tmpbuff[i+3] >= clk-tol) //1.5 to 2 clocks - depends on bit following
410 {
411 complete= true;
412 break;
413 }
414 }
415 end = i;
416 // report back
417 if (verbose || g_debugMode) {
418 if (start >= 0) {
419 PrintAndLog("\nNote: one block = 50 bits (32 data, 12 parity, 6 marker)");
420 } else {
421 PrintAndLog("No data found!, clock tried:%d",clk);
422 PrintAndLog("Try again with more samples.");
423 PrintAndLog(" or after a 'data askedge' command to clean up the read");
424 return 0;
425 }
426 if (!complete)
427 {
428 PrintAndLog("*** Warning!");
429 PrintAndLog("Partial data - no end found!");
430 PrintAndLog("Try again with more samples.");
431 }
432 } else if (start < 0) return 0;
433 start = skip;
434 snprintf(tmp2, sizeof(tmp2),"%d %d 1000 %d", clk, invert, clk*47);
435 // get rid of leading crap
436 snprintf(tmp, sizeof(tmp), "%i", skip);
437 CmdLtrim(tmp);
438 bool pTest;
439 bool AllPTest = true;
440 // now work through remaining buffer printing out data blocks
441 block = 0;
442 i = startblock;
443 while (block < 6) {
444 if (verbose || g_debugMode) PrintAndLog("\nBlock %i:", block);
445 skip = phaseoff;
446
447 // look for LW before start of next block
448 for ( ; i < j - 4 ; ++i) {
449 skip += tmpbuff[i];
450 if (tmpbuff[i] >= clk*3-tol && tmpbuff[i] <= clk*3+tol)
451 if (tmpbuff[i+1] >= clk-tol)
452 break;
453 }
454 skip += clk;
455 phaseoff = tmpbuff[i+1]-clk;
456 i += 2;
457 if (ASKmanDemod(tmp2, false, false) < 1) {
458 save_restoreGB(0);
459 return 0;
460 }
461 //set DemodBufferLen to just one block
462 DemodBufferLen = skip/clk;
463 //test parities
464 pTest = EM_ByteParityTest(DemodBuffer,DemodBufferLen,5,9,0);
465 pTest &= EM_EndParityTest(DemodBuffer,DemodBufferLen,5,9,0);
466 AllPTest &= pTest;
467 //get output
468 Code[block] = OutputEM4x50_Block(DemodBuffer,DemodBufferLen,verbose, pTest);
469 if (g_debugMode) PrintAndLog("\nskipping %d samples, bits:%d", skip, skip/clk);
470 //skip to start of next block
471 snprintf(tmp,sizeof(tmp),"%i",skip);
472 CmdLtrim(tmp);
473 block++;
474 if (i >= end) break; //in case chip doesn't output 6 blocks
475 }
476 //print full code:
477 if (verbose || g_debugMode || AllPTest){
478 PrintAndLog("Found data at sample: %i - using clock: %i", start, clk);
479 end = block;
480 for (block=0; block < end; block++){
481 PrintAndLog("Block %d: %08x",block,Code[block]);
482 }
483 if (AllPTest)
484 PrintAndLog("Parities Passed");
485 else
486 PrintAndLog("Parities Failed");
487 PrintAndLog("Try cleaning the read samples with 'data askedge'");
488 }
489
490 //restore GraphBuffer
491 save_restoreGB(0);
492 return (int)AllPTest;
493 }
494
495 int CmdEM4x50Read(const char *Cmd)
496 {
497 return EM4x50Read(Cmd, true);
498 }
499
500 int CmdReadWord(const char *Cmd)
501 {
502 int Word = -1; //default to invalid word
503 UsbCommand c;
504
505 sscanf(Cmd, "%d", &Word);
506
507 if ( (Word > 15) | (Word < 0) ) {
508 PrintAndLog("Word must be between 0 and 15");
509 return 1;
510 }
511
512 PrintAndLog("Reading word %d", Word);
513
514 c.cmd = CMD_EM4X_READ_WORD;
515 c.d.asBytes[0] = 0x0; //Normal mode
516 c.arg[0] = 0;
517 c.arg[1] = Word;
518 c.arg[2] = 0;
519 SendCommand(&c);
520 return 0;
521 }
522
523 int CmdReadWordPWD(const char *Cmd)
524 {
525 int Word = -1; //default to invalid word
526 int Password = 0xFFFFFFFF; //default to blank password
527 UsbCommand c;
528
529 sscanf(Cmd, "%d %x", &Word, &Password);
530
531 if ( (Word > 15) | (Word < 0) ) {
532 PrintAndLog("Word must be between 0 and 15");
533 return 1;
534 }
535
536 PrintAndLog("Reading word %d with password %08X", Word, Password);
537
538 c.cmd = CMD_EM4X_READ_WORD;
539 c.d.asBytes[0] = 0x1; //Password mode
540 c.arg[0] = 0;
541 c.arg[1] = Word;
542 c.arg[2] = Password;
543 SendCommand(&c);
544 return 0;
545 }
546
547 int CmdWriteWord(const char *Cmd)
548 {
549 int Word = 16; //default to invalid block
550 int Data = 0xFFFFFFFF; //default to blank data
551 UsbCommand c;
552
553 sscanf(Cmd, "%x %d", &Data, &Word);
554
555 if (Word > 15) {
556 PrintAndLog("Word must be between 0 and 15");
557 return 1;
558 }
559
560 PrintAndLog("Writing word %d with data %08X", Word, Data);
561
562 c.cmd = CMD_EM4X_WRITE_WORD;
563 c.d.asBytes[0] = 0x0; //Normal mode
564 c.arg[0] = Data;
565 c.arg[1] = Word;
566 c.arg[2] = 0;
567 SendCommand(&c);
568 return 0;
569 }
570
571 int CmdWriteWordPWD(const char *Cmd)
572 {
573 int Word = 16; //default to invalid word
574 int Data = 0xFFFFFFFF; //default to blank data
575 int Password = 0xFFFFFFFF; //default to blank password
576 UsbCommand c;
577
578 sscanf(Cmd, "%x %d %x", &Data, &Word, &Password);
579
580 if (Word > 15) {
581 PrintAndLog("Word must be between 0 and 15");
582 return 1;
583 }
584
585 PrintAndLog("Writing word %d with data %08X and password %08X", Word, Data, Password);
586
587 c.cmd = CMD_EM4X_WRITE_WORD;
588 c.d.asBytes[0] = 0x1; //Password mode
589 c.arg[0] = Data;
590 c.arg[1] = Word;
591 c.arg[2] = Password;
592 SendCommand(&c);
593 return 0;
594 }
595
596 static command_t CommandTable[] =
597 {
598 {"help", CmdHelp, 1, "This help"},
599 {"em410xdemod", CmdEMdemodASK, 0, "[findone] -- Extract ID from EM410x tag (option 0 for continuous loop, 1 for only 1 tag)"},
600 {"em410xread", CmdEM410xRead, 1, "[clock rate] -- Extract ID from EM410x tag"},
601 {"em410xsim", CmdEM410xSim, 0, "<UID> -- Simulate EM410x tag"},
602 {"em410xwatch", CmdEM410xWatch, 0, "['h'] -- Watches for EM410x 125/134 kHz tags (option 'h' for 134)"},
603 {"em410xspoof", CmdEM410xWatchnSpoof, 0, "['h'] --- Watches for EM410x 125/134 kHz tags, and replays them. (option 'h' for 134)" },
604 {"em410xwrite", CmdEM410xWrite, 1, "<UID> <'0' T5555> <'1' T55x7> [clock rate] -- Write EM410x UID to T5555(Q5) or T55x7 tag, optionally setting clock rate"},
605 {"em4x50read", CmdEM4x50Read, 1, "Extract data from EM4x50 tag"},
606 {"readword", CmdReadWord, 1, "<Word> -- Read EM4xxx word data"},
607 {"readwordPWD", CmdReadWordPWD, 1, "<Word> <Password> -- Read EM4xxx word data in password mode"},
608 {"writeword", CmdWriteWord, 1, "<Data> <Word> -- Write EM4xxx word data"},
609 {"writewordPWD", CmdWriteWordPWD, 1, "<Data> <Word> <Password> -- Write EM4xxx word data in password mode"},
610 {NULL, NULL, 0, NULL}
611 };
612
613 int CmdLFEM4X(const char *Cmd)
614 {
615 CmdsParse(CommandTable, Cmd);
616 return 0;
617 }
618
619 int CmdHelp(const char *Cmd)
620 {
621 CmdsHelp(CommandTable);
622 return 0;
623 }
Impressum, Datenschutz